Breaches and incidents
National Testing Agency (India): NEET candidate accounts hijacked to divert exam-fee refunds
Ahmedabad Cyber Crime Branch, working with NTA, arrested Navinkumar Yadav, 19, of Gaya, Bihar.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Ahmedabad Cyber Crime Branch, working with NTA, arrested Navinkumar Yadav, 19, of Gaya, Bihar; police say about 350 NEET candidate accounts were targeted and about 150 accessed, and bank details were replaced so refunds (Rs 1,700 each, after the cancelled NEET-UG 2026) went to him (IANS).
- Root cause: brute-forcing weak passwords and abusing a “Forgot Password” flow based on security questions such as favourite colour or sport. Police: “Cyber criminals exploited vulnerabilities in the password recovery system”.
- Attacker: individual, arrested.
- Response: accounts frozen; NTA Director Akash Jain said lessons from the investigation “helped strengthen the portal’s security features”.