Crime Reporting Chronicles: Pissing Off A Hacker

In 2023, I was with the Hindustan Times and while I was still covering the crime beat, I was also digging deeper into cybersecurity as a beat. But my whole purpose was to write about cybersecurity in a language that everybody would understand, and to bring news from that domain out of the Science and Tech pages to the mainstream news pages. This was also a crucial time for me, as I had endured a lay off during the pandemic and was working my way back into mainstream journalism after a year and a half of taking any job that came my way. Cybersecurity was a way for me to prove I was more than just my past laurels, and hence, I was hitting that battlefield pretty hard.

In February 2023, a huge chunk of user data was hacked from the servers of Rail Yatri, an app used by Indians to book train tickets and for other travel related functions. It is a privately owned app but endorsed by the Indian Railway Ministry, which is why it has a massive user base across India.

The data includes names and contact details of around 3.1 crore users, and was over 12.33 GB in size. It was offered for sale on Breached Forums, a known hackers' den on the dark web, by a user whose bio said he was from Israel. The seller had a VIP profile, which makes you a pretty big deal on Breached Forums.

I scoured high and low for a good angle and ultimately realized that the only way I'd be able to make the story more interesting for the lay reader was to go beyond writing the usual explainer of "why you should be concerned about data leaks". I had to try and interview the hackers.

I tapped some contacts in the cybersecurity community and by evening, I had a Telegram ID for the person who had offered the data for sale. I sent him a text and he was abrasive as heck. He offered to sell me a sample for USD 300 and when I said I'd have to seek approval for my office, he replied saying, "Can't even afford $300? You Indians are such losers." Fortunately, insults was something I was immune to, thanks to an abusive step father, a toxic ex and a string of condescending ex-bosses.

I told him that I wanted to speak to someone who could actually talk about the hack, and that he knew where to find me in case someone was interested. A day later, he came back to tell me that his boss would give me an interview over Telegram chat.

I had a pretty successful interview with the top boss, who turned out to be very sensible, polite and patient. I published the entire interview the next day, detailing just how weak our cybersecurity was and how the hacker group had managed to reach Rail Yatri servers through phishing emails sent to employees. (You can read the article here)

A few hours after the interview, however, the chap I'd first spoken to, the abrasive insult-thrower, came back online.

"Why did you write that I was offering the data for sale?" he asked. "We're giving it away for free. We just want to show how serious the issue is."

I tried telling him that I had only quoted him verbatim but he said, "I was joking. Why are you maligning our image?"

I scrolled up the window to see that he had started deleting his earlier messages. I realized that he'd been yelled at by his boss, and, chuckling, sent him screenshots of our earlier conversation.

"On the off chance that you get to speak to a journalist again," I told him, "I'd suggest keeping the conversation professional instead of resorting to insults and jokes."

The hacker let loose a string of threats, warning me that he would hack all my devices and make life miserable for me. I took a screenshot and blocked him.

As I set about changing all my passwords and installing latest security updates on all my devices, I found myself thinking of how this was so similar to the crime reporting of yore, where organized crime gangs could pick up the phone and threaten you every time they didn't like what you wrote about them. I harked back to the time I'd spent under round the clock police protection. But that is a story for another time.

Thank you for reading, and stay tuned!