(Update: Tender withdrawn) IRCTC plans to monetise railway user data

[Yashvardhan Jain]

https://twitter.com/i/web/status/1563164121704460289

Source

 

[Bapun Raz]

The tender had alarmed activists who said it could lead to a violation of privacy of people who have used IRCTC’s services since it sought to analyse data points like their names, contact numbers, addresses and even “login/password” credentials.

Indian Railways’ catering and ticketing arm Indian Railway Catering and Tourism Corporation (IRCTC) has withdrawn a controversial tender — which proposed hiring a consultant to monetise a bulk of its passengers’ data — since the government has withdrawn the data protection Bill.

IRCTC withdraws tender on data monetisation

The tender had alarmed activists who said it could lead to a violation of privacy of people who have used IRCTC’s services since it sought to analyse data points like their names, contact numbers, addresses and even “login/password” credentials.

indianexpress.com

https://irctc.com:8080/IRCTC/downloadUploadTenderFile?fileName=uploadTender-349-29_08_2022.pdf

Very surprising that they were willing to sell the login and password credentials as well!

 

[U999X0D]

https://irctc.com:8080/IRCTC/downloadUploadTenderFile?fileName=uploadTender-349-29_08_2022.pdf

Exposing the port number directly. Very typical Sarkaari govt agency.
If we go to the homepage of this site, it is also directly exposing the Tomcat server..