Breaches and incidents
Rajasthan Public Service Commission (India): recruitment portal accessed, results and applications tampered with
Amar Ujala reports police cyber crime officials described unauthorised entry into the RPSC recruitment portal and tampering with exam results, candidate...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Amar Ujala reports police cyber crime officials described unauthorised entry into the RPSC recruitment portal and tampering with exam results, candidate merit lists and application records; Additional DGP (Cyber Crime) V.K. Singh described it as a case of unauthorised portal access and record tampering.
- Root cause: not formally disclosed. Police then listed four common weaknesses in institutional portals: missing server-side authorisation checks, SQL injection, no re-verification on password reset, and no limits on login/OTP/reset attempts.
- Attacker: not identified.
- Response: Rajasthan Police Cyber Crime Branch issued an advisory to universities and institutions: server-side authorisation on every request, UUIDs instead of sequential IDs, parameterised queries, re-verification before password change, MFA for sensitive actions, rate limits.