DRDO data breach: Alibi Global’s Claim

When Alibi Global, a firm that monitors dark-web forums and ransomware sites for law-enforcement and government clients, reported a listing offering roughly 31 GB of alleged DRDO and Indian military-project data for about USD 8,000, it was a serious claim that deserved serious scrutiny. What followed instead was a familiar script: The Defence Ministry swiftly dismissed the reports as “incorrect and unverified,” declared the matter closed, and moved on. That response should not be accepted uncritically. It is not evidence of a resolved non-issue, it is exactly the kind of self-serving, self-audited denial that governments reach for whenever a security lapse threatens to become an embarrassment.

The most basic problem with the ministry’s rebuttal is structural: the accused party conducted its own investigation and cleared itself. There is no mention of an independent, third-party forensic audit, no external cybersecurity agency, no CERT-In verification made public, no chain-of-custody analysis of the sample documents that Alibi Global says it examined. “Thorough investigation found no evidence” is a conclusion asserted, not demonstrated. A ministry with every institutional incentive to minimize alarm telling the public that nothing is wrong is not the same as an incident being genuinely resolved. Given DRDO’s history of prior breaches, that gap in independent verification should trouble anyone taking the story at face value, rather than reassure them.

Look closely at the ministry’s own language and the reassurance collapses under its own logic. It claims there is “no evidence of any active cyberattack, unauthorised network intrusion, or ongoing data exfiltration” while simultaneously admitting the material “largely comes from an old data breach (2020–2022 vintage).” That is not a rebuttal of a breach; it is a confirmation of one, just an older one that the ministry would prefer not be discussed. Calling old, stolen, restricted-looking data “unclassified” and irrelevant does not undo the fact that sensitive material, reportedly including items tied to missile systems and senior scientists’ signatures, left DRDO’s custody at some point and has been circulating in criminal marketplaces for years, resold across “multiple threat actors.” A ministry genuinely confident in its security posture would explain how that happened and what was done to contain it, not simply relabel it “old news” and consider the matter settled.

The ministry’s statement does a great deal of work to reframe severity downward, “unclassified,” “no confidentiality,” “outdated,” “multiple revisions,” “unverifiable”, without offering a single verifiable detail to support any of these characterizations. No breach date is confirmed. No scope of the 2020–2022 incident is disclosed. No explanation is given for why data allegedly containing scientists’ approvals and missile-linked technical material would be classified as carrying “no confidentiality” in the first place. This is not transparency; it is a press-release style deflection engineered to end scrutiny rather than survive it. If the ministry genuinely wants public confidence, vague reassurance dressed as certainty is the wrong instrument.

The more the ministry insists this is a non-story, the more its own account undercuts that position. An old breach that was apparently significant enough to produce documents now being sold years later as “recent and confidential” is not a closed chapter, it is an open failure of remediation and monitoring that has never been publicly accounted for. Instead of a defensive posture designed to make the story disappear, what the situation calls for is an independent audit, public disclosure of the original 2020–2022 breach’s scope, and an explanation of why compromised material is still commercially viable on criminal forums half a decade later. Until the ministry offers that level of transparency, its rebuttal should be read for what it is: institutional damage control, not proof that Indian defence data is secure.