Your Number Plate Is a ₹5 Data Leak — The VAHAN Telegram Scandal and What Every Indian Driver Must Do Now (2026)

What Happened: The ₹5 Vehicle Data Scandal

In September 2026, cybersecurity firm Cyderes published an investigation exposing a Telegram-based service that was selling complete Indian vehicle owner records for as little as ₹5 per query. You typed in a number plate. You paid ₹5. You received the owner's full name, father's name, home address, pincode, and mobile number.

No verification. No reason required. Anyone with ₹5 and a vehicle registration number could extract a complete dossier on any vehicle owner in India.

The Internet Freedom Foundation, which filed RTI applications with MoRTH and the National Informatics Centre (NIC), found that 338 private-entity credentials had been issued access to India's VAHAN database. Those credentials had been used to make 17,079,998 queries between January 2024 and September 2026. Many of those queries — and the data extracted — were never authorised for the purpose they were used for.

On October 25, 2026, the Ministry of Road Transport and Highways ordered CERT-In (India's Computer Emergency Response Team) to conduct a forensic security audit of the VAHAN, SARATHI, e-Challan and PUCC portals. Access for private entities was halted.

What Data Was Being Sold

According to the Cyderes investigation and Times Now reporting, a single vehicle registration number returned:

• Full name of the registered owner
• Father's name
• Present address
• Permanent address
• Pincode
• Mobile phone number
• Vehicle registration date and history

This is not anonymised summary data. This is a complete personal profile — the kind that enables stalking, targeted harassment, doorstep fraud, and identity theft.

Why This Specifically Affects Women and Vulnerable Drivers

For women who drive alone, for families in contested property disputes, for anyone who has received threats — the idea that any stranger with ₹5 and your number plate can find your home address is not an abstract data policy concern. It is a direct personal safety threat.

Consider the specific risk: a woman drives alone to a market. Her car is noted by someone with hostile intent. They use a ₹5 Telegram bot to get her home address. They are waiting for her when she gets home.

This is not hypothetical. The Delhi High Court had already sought a government response in 2024 to a PIL about apps leaking vehicle owner data. The 2026 scandal is the same problem at industrial scale.

The Dashboard Phone Number Makes It Worse

Millions of Indian car and bike owners display their phone number on the dashboard or rear window to handle parking requests. This was understandable before privacy was a concern. It is no longer defensible in 2026.

Here is the combined risk exposure if you display your phone number on your dashboard:

• Your number plate → can be used to find your home address via illicit Telegram bots (₹5)
• Your displayed phone number → immediately visible to any stranger who walks past your parked car
• Combined: a stranger now has your phone number AND your home address, extracted from your parked vehicle in under 2 minutes

This is not a theoretical attack chain. It is a trivially executable sequence available to anyone in 2026.

How VahanTag Breaks This Chain

VahanTag replaces the dashboard phone number with an anonymous QR relay system. Here is what changes:

• No phone number displayed: Anyone who looks at your car sees only a QR sticker. Your number is not visible to passers-by, stalkers, or hostile actors.
• Contact is proxied: When someone scans your VahanTag QR, they can send you a message — but your phone number is never transmitted to them or displayed at any point.
• QR cannot be reverse-queried: Unlike a number plate, your VahanTag QR code contains no personal data. Scanning it opens a relay form. There is no data to extract.
• You control contact: You receive the alert on WhatsApp or SMS. You decide whether and how to respond. The scanner has no way to follow up or escalate contact.

Even if your number plate is used to obtain your address through illicit means, removing your phone number from display eliminates one layer of the combined attack.

What Should You Do Right Now

1. Remove Your Phone Number from Your Dashboard

If you have a piece of paper with your phone number taped to your dashboard or rear window, remove it. The risk is no longer theoretical. Replace it with an anonymous contact solution.

2. Check If Your Data Is Exposed

Visit the official VAHAN e-Services portal (vahan.parivahan.gov.in) and check what public information is currently visible for your vehicle. You cannot remove your registration data, but knowing what is visible helps you understand your exposure.

3. Be Cautious About Third-Party Apps That Request Vehicle Data

Many apps request permission to look up vehicle registration data for "insurance" or "FASTag" purposes. Restrict this access unless the app has a clear, legitimate reason. The Delhi HC PIL specifically flagged apps on the Google Play Store that were leaking vehicle owner data.

4. File a Complaint If You Suspect Misuse

If you receive unexpected calls or messages referencing your vehicle, file a complaint with your local cybercrime cell (cybercrime.gov.in) and with CERT-In. The DPDP Act 2023, once fully enforced, provides for penalties for unauthorised data processing.

5. Switch to Anonymous Vehicle Contact

Replace dashboard phone numbers with a VahanTag QR sticker. Your vehicle remains contactable for legitimate parking and safety reasons — but your phone number stays completely hidden from anyone who approaches your car.

Physical Tag or Digital E-Tag?

• Physical Tag (₹499 + GST): 2 automotive-grade weather-proof QR stickers. Shipped free across India. For 4+ wheelers.
• Digital E-Tag (₹299 + GST): Instant PDF download. Works for all vehicles — bikes, autos, cars, trucks. Active within 2 minutes of payment.