Hyderabad complaint helps cops bust Noida-based gang selling confidential data of 16.8 crore people

The seven arrested were identified as Kumar Nitish Bhushan, Pooja Pal, Susheel Thomar, Atul Pratap Singh, Muskan Hassan, Sandeep Pal, and Zia Ur Rehman.

Under the new data protection law brought in by the Union government in 2022 — the Digital Personal Data Protection Bill — personal data may be processed only for a lawful purpose for which an individual has given consent.

Who were targeted?

The cops said that the accused were selling information across around 140 categories.

This included selling data of defence personnel with their ranks, email ids, and place of posting.

The data of the NEET students with their names, father’s names, mobile numbers, and addresses were also found with the gang.

The cops added that the accused also had a PAN Card database, with information on income, email addresses, phone numbers, and physical addresses.

Cyberabad cops and commissioner Stephen Raveendra present the seized material. (Supplied)

The data of government employees and those from gas and petroleum companies, with information on their names, mobile numbers, categories, and date of birth, was also found.

The cops added that the mobile numbers of 3 crore individuals were probably leaked from Telecom Service Providers, because they came with the order number, service start date, segment details, billing details account number, and SIM number.

The cops said that these details could be used in the commission of various crimes.

Data of credit and debit cards, and account details from banks such as Axis Bank and HSBC, was also recovered.

The WhatsApp data of 1.2 crore users with their state details were also found on the accused.

The cops added that data of 17 lakh Facebook users with login username, IP city, age, email address, and phone number information was also found.

Similarly, the data of energy and power-sector companies, HNIs, DEMAT accounts, students’ database, women’s database, consumer data of women from Bengaluru, data of people who applied for loans and insurance, data of IT organisation employees, frequent flyers, and others were also found, said the police.

How did the gang operate?

As per the cops, the gang operated through three registered and unregistered companies — Data Mart Infotech, Global Data Arts, and MS Digital Grow.

They added that the kingpin Bhushan started a call centre in Noida in Uttar Pradesh and collected credit card databases from Muskan Hassan.

Seized phones and CPUs from the seven accused. (Supplied)

Pooja and Susheel were working as tele-callers at Bhushan’s call centre.

The cops added that Atul Pratap collected the data of credit card holders and sold it through his company Inspiree Digital.

Hassan, who was a former tele-caller at Atul’s office, started the company MS Digital Grow.

“She was selling data as a mediator. She procured the data from Atul and sold it to Bhushan,” the cops said.

They added that Global Data Arts was started by Sandeep. “He used Justdial services and social media platforms to sell customers’ confidential data to fraudsters, indulging in cybercriminals,” the cops claimed.

Meanwhile, Rehman provided bulk messaging services for promotions and also shared the database with Atul and Bhushan, the police said.

Seized phones and laptops from the seven accused. (Supplied)

The cops added that when any individual called the toll-free numbers of Justdial to ask for confidential data of individuals, their query was listed and sent to that category of the service provider.

“Then these fraudsters would call those ‘clients’ and send them samples. If the client agreed to purchase them, they made payment and were provided with the data. This data was further used for committing a crime,” the cops claimed.

The police seized several mobile phones, laptops, CPUs, mail, and tax invoices of Justdial, and data across 138 categories with confidential information of government and private organisations and individuals.