Exposed .env Credentials Enabled Unauthorized Access to BWSSB Database and 291,000 Applicant Records

Summary

CloudSEK reports that exposed database credentials in a publicly accessible .env file enabled root-level access to BWSSB’s database, compromising more than 290,000 applicant records. The credentials were later invalidated; a claimed backdoor was unverified.

Key points

A threat actor advertised BWSSB database access and a data dump containing records for 291,212 users.
CloudSEK found a publicly accessible .env file on owc[.]bwssb[.]gov[.]in containing valid MySQL credentials, alongside an exposed Adminer interface.
The report says the actor used the credentials to obtain root-level database access; the compromised data reportedly did not include passwords.
The applicant records included personal information such as names, phone numbers, addresses, email addresses, and Aadhaar numbers.
At the time of reporting, the .env file was no longer accessible and the exposed credentials had been invalidated.
The actor claimed to retain access through a backdoor, but CloudSEK said it had not independently verified that claim.
CloudSEK recommended auditing the affected infrastructure, rotating potentially exposed credentials, and restricting public access to administrative interfaces.

Article Details

Victim Organization: The Bangalore Water Supply and Sewerage Board (BWSSB)
Victim Domain: owc.bwssb.gov.in
Incident Type: Unauthorized database access and exposure of applicant records, followed by an advertised sale of database access and data
Data Types Exposed: Full names
Phone numbers
Complete addresses
Email addresses
Aadhaar numbers
Payment data
Application data
Grievance data
System logs
Affected Records: The threat actor's post claimed 291,212 user records; CloudSEK reported more than 290,000 records. The post stated that passwords were not included.
Operational Impact: CloudSEK concluded with high confidence that the actor obtained unauthorized root-level database access using valid credentials exposed in a publicly accessible .env file. The report describes potential disruption or data manipulation but does not report that these occurred.
Ransom Or Extortion: The threat actor advertised database access for $500 and reportedly appeared willing to negotiate a lower price. The actor claimed to retain access through a backdoor, which CloudSEK had not independently verified. No ransom demand against BWSSB is reported.
Claim Status: confirmed