Critical Flaw Leaks Sensitive Data of Organ Donors

Quick Summary:

• A critical vulnerability in the Organ retrieval Banking Organisation (ORBO) website of AIIMS, New Delhi exposed sensitive data of voluntary organ donors across India.
• The data included names, addresses, blood groups, mobile numbers, emergency contacts, adn medical details without any authentication protection.
• The breach posed risks like identity theft and phishing attacks and violated privacy principles under the Digital personal Data Protection Act (DPDP), 2023.
• Security researcher Aniket Tomar discovered the flaw in May 2025 and alerted CERT (Computer Emergency Response Team).
• Mr. Tomar stressed ethical concerns surrounding public trust erosion in digital health systems due to such breaches.
• CERT lauded the researcher’s efforts on June 18,2025; the vulnerability was mitigated promptly after notification.

Indian Opinion Analysis:

Data protection holds significant importance as India’s healthcare infrastructure increasingly digitizes operations. This breach highlights systemic vulnerabilities even within reputed institutions like AIIMS. The exposure of sensitive details not only endangers individual donors but also undermines public confidence in organ donation systems-a critical area where trust plays a pivotal role.

Mitigation after discovery suggests that immediate action is possible when ethical cybersecurity practices uncover flaws. However, regular audits of government healthcare portals are essential to prevent recurrence. This incident underscores an urgent need for stricter compliance enforcement under India’s DPDP Act to safeguard personal data amid growing reliance on technology in healthcare services.

Read more: The Hindu