Surfshark, as a popular virtual private network (VPN) service provider, is already on a collision course with the government, and has announced the removal of all its India-based VPN servers, rejecting the directions of the Indian Computer Emergency Response Team (CERT-In)
The Netherlands-based company is opposed to CERT-In's new directions, issued on April 28, which tells service providers to collect and store users' data — names, addresses, contact numbers, email, and IP addresses — for up to five years and hand over this information if requested.
Opposing this move, Surfshark said that its servers will be shut down in India before June 27, when CERT-In's new rules will come into effect.
Meanwhile, Surfshark, in a separate study, has ranked India as the 6th most breached country since the first recorded digital attacks in 2004. And the company said that the newly-introduced CERT-In law, which orders companies to store and hand-over large amounts of customers’ personal data upon request, increases the risk of leak from databases.
"Indians lose 3.8 data points per data breach"
Whether Surfshark is trying to make a case against CERT-In's new rules with its study or not, the numbers look a bit sobering. Surfshark's analysis of 15 billion breached accounts shows that: Since 2004, 14.9 billion accounts have been leaked, and 254.9 million of them belong to users from India. This makes India 6th in the world by the number of breached users. Around 962.7 million Indian data points have been leaked so far, most of them passwords, names and telephone numbers --- Statistically, per every 10 leaked accounts in India, half are stolen together with a password.
"Indians lose 3.8 data points per data breach, while the global average is only 2.3. Some of the reasons for this could be user habits or data collection practices of Indian online services and applications," Surfshark said.
As of June 1, only two months into the quarter, India's breach rate is 740% higher than in 2022 Q1, rising from 5 to 42 breached accounts per minute.
Further, Indian internet users are also increasingly targeted by cybercriminals. In 2021, the CERT-In team handled over 1.4 million incidents involving phishing attacks, probing, viruses, malware, and others, and showed 21% increase compared to 2020 even if many remain unreported.
