Evil Markhor claims leak of more than 15,000 Indian Army personnel records
Threat actor Evil Markhor claims it breached systems linked to the Indian Army website under India's Ministry of Defence and leaked about 3 GB of internal data, including more than 15,000 personnel records. The Indian Army and MoD have not confirmed an incident; DailyDarkWeb calls the claim unverified and notes hacktivist claims in this space are often exaggerated. If real, the material, which allegedly includes plaintext passwords, raises phishing and espionage risks for serving soldiers and veterans.
What happened
A threat actor using the name Evil Markhor claims it breached systems linked to the Indian Army website under India's Ministry of Defence and leaked about 3 GB of internal data. The material allegedly includes more than 15,000 personnel records with service numbers, ranks, units, contact details, next of kin and medical information. The Indian Army and MoD have not confirmed an incident.
Why it matters
If real, the leak exposes serving soldiers, veterans and their families to targeted phishing, social engineering and espionage, according to DailyDarkWeb. Dental Corps recruitment dossiers allegedly contain plaintext passwords, which could open the door to further access. The same report notes hacktivist claims in this space are often exaggerated.
What to do
Treat the case as an unverified claim until official confirmation. Enable credential monitoring and strengthen defenses against phishing aimed at people connected to Indian defense. Force password resets on any cited systems if the breach is confirmed.
For the technical team
- Affected
- Exército da Índia (Ministério da Defesa) Sistemas ligados ao site do Exército indiano; registros de pessoal e arquivos internos do Ministério da Defesa, segundo · Systems linked to the Indian Army website (India's Ministry of Defence), per the actor's claim. No specific product or version cited.
- Exploitation
- Breach and leak claim posted by threat actor Evil Markhor and reported by DailyDarkWeb. No confirmation from the Indian Army or MoD; no PoC, KEV or active exploitation reported.
- Fix
- No fix applicable: this is a claimed system intrusion with no identified software vulnerability. No official response published.
- Vector
- Intrusion method not described in the source. The actor claims access to systems linked to the Indian Army website under the Ministry of Defence; no specific vulnerability was cited.
- More details
- Alleged material includes CSD car sanction lists, gazettes, veteran address books, internal MoD correspondence and Dental Corps recruitment dossiers containing plaintext passwords, according to the actor. The same actor name surfaced in an earlier claim against Indian defense firm Bharat Electronics. DailyDarkWeb classifies the case as an unverified threat-actor claim, not confirmation of a breach.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
