Seventeen million. That is how many times India's vehicle and licensing databases were queried through credentials held by private entities between January 2024 and September 2026, according to the first official accounting of the practice obtained through the Right to Information Act. The figure comes from the National Informatics Centre, which built and runs VAHAN, SARATHI, e-Challan and PUCC. The Ministry of Road Transport and Highways, which alone holds the names of the companies behind those queries and which ordered their access switched off on 1 October 2026, answered none of twelve questions put to it and disposed of the application in two days.
A system opened, then quietly closed
The numbers themselves describe a data pipeline operating at a scale few outside government had previously confirmed. NIC's reply records 338 credentials currently held by private entities against 62 for government bodies, a cumulative 25,314 credentials issued to private parties over the period, and monthly query volumes that averaged nearly 700,000 through mid-2025 before falling sharply. The decline began in August 2025, the same month MoRTH circulated a new data-sharing policy for its National Transport Repository, and continued through September 2026, the final and lowest month in the series at under 193,000 queries. NIC offers no explanation for either the scale or the drop. Nor does it explain why the credential count differs by orders of magnitude depending on whether one reads the "recorded" figure or the "issued" figure - a gap that likely reflects renewals and expirations, but which the reply does not clarify.
A disclosure that went nowhere
Months before the formal shutdown, a security firm had already reported that VAHAN records were being sold live on Telegram for a few rupees a query, drawn through API credentials issued to licensed intermediaries rather than through any breach of a government server. That disclosure reached CERT-In and NIC on 1 June 2026. Asked what action followed and when any credential was revoked, NIC's answer was blunt: that information "is not specified in the inputs presently available." A body responsible for operating systems holding the personal data of hundreds of millions of vehicle owners had, more than four months later, no retrievable record of its own response to a confirmed data-sale complaint.
The retention schedule NIC disclosed compounds the problem. API logs are kept for a year, SMS logs for six months, with no indication that preservation was ordered once the complaint arrived. Given that the Telegram operation is reported to have run from September 2025, much of the relevant SMS trail would already be gone, and the API logs will lapse on a rolling basis unless specifically frozen - something the reply does not confirm happened.
A policy history of access and retreat
This is not the first cycle of opening and closing this tap. MoRTH sold bulk access to VAHAN and SARATHI under a 2019 policy that earned over a hundred crore rupees before being withdrawn in 2020 on privacy grounds - a withdrawal that stopped new sales but did nothing to recall data already distributed to more than 170 recipients, including banks, insurers and manufacturers. A 2025 policy reopened API and bulk channels under conditions requiring Aadhaar-linked consent, but it carries no statutory backing, no public recipient register, and no grievance mechanism, while granting law enforcement agencies unrestricted access to personal data fields.
Against that backdrop, a Ministry informed of an active criminal data market responded to a direct question about it by citing the existence of a policy webpage, a week before quietly ending the very arrangement it declined to discuss. Whether the shutdown followed the complaint, preceded it, or arrived independently remains unanswered - and is now the subject of a formal appeal.
