Private firms made 17 million queries on vehicle databases between 2024-2026 before Centre cut access: RTI

On October 1, the Centre discontinued data sharing with private entities from India’s vehicle databases. The National Informatics Centre confirmed the change in a reply dated October 16. The decision matters because private access had enabled thousands of credentials and millions of database queries, raising concerns about personal information reaching commercial services.

The databases included VAHAN, SARATHI and related transport systems. Before access ended, private entities held credentials that allowed them to query vehicle records. An app tested by the Internet Freedom Foundation offered multiple searches for ₹29 and displayed sensitive details using only a registration number.

The change is significant, but important questions remain. NIC did not explain the reason for the decision or when the ministry issued its direction. The article also does not say whether the ban is permanent, whether old records must be deleted, or whether affected vehicle owners will be informed.

Private entities made 17,079,998 queries to India’s national vehicle databases between January 2024 and September 2026. During the same period, the National Informatics Centre disclosed that it issued 25,314 credentials to private entities. These figures reveal both the scale of access and the volume of activity before the Centre ended private data sharing.

The credentials allowed access to VAHAN, SARATHI and related transport databases. NIC’s reply also mentioned 338 credentials for private entities and 62 for government bodies, but did not explain how those figures related to the larger total of 25,314. The article therefore presents the figures without resolving that apparent difference.

The number of queries matters because each database request could potentially expose vehicle-related information. An Internet Freedom Foundation test found an app offering personal details for ₹29. NIC later confirmed that private sharing stopped on October 1, but did not disclose what happened to earlier records or credentials.

VAHAN and SARATHI are national transport information systems. VAHAN is associated with vehicle registration and related vehicle records. SARATHI is associated with driving licences and driver information. The article identifies both as databases operated through systems run by the National Informatics Centre, alongside other transport databases.

The article’s examples show the sensitivity of information connected to these systems. A vehicle-information app reportedly returned an owner’s full name, father’s name, present and permanent addresses, insurance policy number, financier, chassis and engine numbers, and pollution-certificate details. It did so after receiving only a vehicle registration number.

The official Parivahan portal masks several of these details and requires an account verified through a mobile OTP. The article does not provide a complete list of VAHAN or SARATHI fields, nor does it separately identify which database supplied each detail. It does show why access to linked transport records requires careful controls.

A vehicle registration number can identify a record in a transport database. If a service has authorised credentials and weak restrictions, it can submit that number as a query and receive linked information. That turns an ordinary number visible on a vehicle into a possible gateway to personal and financial details.

The Internet Freedom Foundation tested an app with more than 10 million downloads. For ₹29, it offered 15 searches. The app returned the owner’s full name, father’s name, present and permanent addresses, insurance policy number, financier, chassis and engine numbers, and pollution-certificate details. The official Parivahan portal masks several details and requires mobile-OTP verification.

This access reportedly continued through private services even though the government portal applied stronger limits. NIC later confirmed that private data sharing stopped on October 1. The app remained available on Google Play Store as of October 17, so discontinuing database access did not immediately remove every service advertising such information.

Misuse could occur when a company uses legitimate credentials for purposes beyond the access originally allowed. Instead of checking information for an approved identity-verification task, a credential holder could repeatedly query records and pass the results to a paid app, website or Telegram seller. That would exploit authorised access rather than require a direct breach of a government server.

A September 1 report by cybersecurity firm Cyderes described a Telegram-based service selling vehicle records for ₹5 per lookup. It said the service used credentials linked to licensed identity-verification companies. The Internet Freedom Foundation connected these findings to the possibility that authorised access was being misused. Its own test found an app offering sensitive details for ₹29.

NIC confirmed receiving a June 1 disclosure to CERT-In about vehicle records allegedly sold through Telegram. However, NIC said it did not have information on action taken or credential revocation. API logs were retained for one year and SMS logs for six months, which could limit later investigations.

The National Informatics Centre runs the vehicle database systems and answered IFF’s RTI questions. It disclosed credential and query figures, confirmed that private sharing stopped on October 1, and acknowledged receiving a disclosure about vehicle records allegedly sold through Telegram. NIC also said relevant action and credential-revocation details were unavailable.

The Ministry of Road Transport and Highways directed the discontinuation of private data sharing. It also handled IFF’s RTI application, though it disposed of it within two days and referred IFF to the ministry website and state or Union territory responsibility. CERT-In received the June 1 disclosure concerning alleged sales through Telegram.

The Internet Freedom Foundation tested a vehicle-information app, published concerns, wrote to the authorities and filed RTIs. It is challenging MoRTH’s response and appealing NIC’s reply. IFF is seeking clarity about permanence, deletion of old records, owner notification, access lists and stronger safeguards.

Government databases need access controls because personal information should be available only to approved users for defined purposes. Controls can limit which records a credential can reach and how often it can be used. Data minimisation adds another layer by reducing the amount of personal information returned when a full record is unnecessary.

Activity logs are equally important. They can show which credential made a query, when it happened and what system was accessed. In this case, NIC said API logs were retained for one year and SMS logs for six months. If records disappear too quickly, investigators may struggle to identify misuse or determine whether credentials were revoked.

The reported resale of vehicle records shows the consequences of weak safeguards or misuse by authorised users. Stopping private sharing was a major change, but IFF is seeking stronger technical protections, a public access list and clarity about old records. The article does not describe specific new controls already introduced.