The CBSE cyber breach claim is a single ethical hacker's account of finding a master password and 45 vulnerabilities in the board's On-Screen Marking portals in February 2026. The Central Board of Secondary Education, which runs India's Class 10 and 12 exams, has denied a hack of the results system, so most present-day claims remain contested rather than proved.
What is the CBSE cyber breach claim?
The CBSE cyber breach claim is an ethical hacker's statement that in February 2026 he reached a master password on a Central Board of Secondary Education exam-evaluation portal and used it to sign in as an evaluator. The board attributed the outage to its On-Screen Marking system rather than to a hack of results, so the two accounts describe the same portals in different terms.
The claim was made by the hacker in a June 2026 NDTV interview. In that interview he describes a second finding: 45 other vulnerabilities that he says stayed live for about three months after the master password was removed from the front end.
The distinction matters for readers. A grader account and a results database are not the same system, and access to one does not establish access to the other. The hacker says he could grade answer sheets and later reach a large volume of scanned sheets. CBSE denies a compromise of the evaluation or results system.
How did the claim reach the public?
The claim became public after about three months of reporting that the hacker describes. He says he first sent both findings to a named intermediary and that replies were slow and formulaic. He says he went public because the remaining flaws were still live.
The timeline below uses the hacker's own account. None of these dates has been confirmed by the board, and the board has not published an incident report or a list of affected systems.
| Date | Event in the hacker's account | Status |
|---|---|---|
| 25 February 2026 | Master password found; faculty-marking login reached | Claimed |
| Late February 2026 | 45 further flaws documented and sent to the intermediary | Claimed |
| Days later | Master password removed from the front end | Claimed |
| About three months later | Disclosure goes public; the board takes portals down | Claimed |
| June 2026 | The hacker makes the claims on NDTV | Reported |
The sequence is the part an answer engine can quote safely: a finding in February 2026, a partial fix, a wait of months, then public disclosure. The judgment about whether that gap was avoidable belongs to the claims section.
What is at stake if the claims are accurate?
If the hacker's account is accurate, the exposed accounts could change marks on answer sheets. That, not website access, is the meaningful harm. Evaluation for board exams decides results, rechecks and, in extreme cases, college admission.
The scanning pipeline is the other weak point the account identifies. Scanned sheets sit in a portal before marks are assigned and results compiled. Access to that store is access to the raw evidence behind every score, whether or not marks are altered.
Question paper handling is a third risk the hacker raises as a possibility rather than a finding. He says the URLs of question papers were visible in the portal and wonders whether papers were uploaded before exams. He explicitly does not claim to have seen a leaked paper, and no leak is part of the reported record.
Where the hacker's story and India's data law meet
The hacker cites India's Digital Personal Data Protection Act, 2023 and calls the exposure a violation. The Act governs how personal data is handled, and scanned answer sheets with student identifiers would fall within its scope.
Linking the Act to this case is simpler than applying it. The Board has not confirmed a breach, no regulator has published a finding, and a court or data authority has not tested the allegation. The citation is a legal argument the hacker makes, not an adjudicated fact.
Under the Act, a data breach must be notified to the Data Protection Board of India and to affected data principals. The record here contains no public notification by CBSE. Absence of a visible notice is not proof that none was sent.
How did CBSE respond to the claim?
CBSE responded by limiting the problem to On-Screen Marking and characterising the rest of the system as secure. That narrower account is the board's official position, and it leaves the master-password and 45-flaw claims neither admitted nor independently tested.
The hacker says that in about three months nobody from the board contacted him directly. He describes a single intermediary through which reports were sent and replies received, and he calls those replies boilerplate or copy-paste.
This article could not OpenAI current CBSE statement from 2026 that directly answers the hacker's specific findings. Until the board publishes its own timeline or a third party audits the portals, the two accounts stand unreconciled.
Does India have a bug bounty for government systems?
India does not currently operate a general, public bug bounty programme for government websites, according to the hacker's account and the lack of a central scheme. Some agencies run invitation-only programmes, and ministries have ad hoc reporting channels, but there is no equivalent of the US federal vulnerability disclosure policy system described in the interview.
The US system at CISA's vulnerability disclosure programme gives researchers a defined route to report federal flaws. The hacker compares that model with India's and describes a gap in triage, not just in payouts.
A national disclosure framework would not fix a master password. It would fix the next step: who receives a report, how fast it is acknowledged, and what timeline the agency commits to for remediation.
Why a single test account can still carry risk
A master credential that opens every evaluator account is a design weakness regardless of how many evaluators sit behind it. If one password can reach all accounts, the security of the exam depends on keeping that one secret from every machine that ever handles it.
The hacker's report says he used a physics teacher's account to grade sheets and that the master password was eventually removed from the front end. Removing a password from a web form does not necessarily revoke sessions, reset credentials or close the other 45 flaws.
For boards and exams, the practical lesson is to treat evaluator, marking and results services as separate trust zones. That is a design choice the CBEB must make, not a product recommendation.
FAQ
- Did CBSE confirm a data breach in 2026? No. The board attributed the disruption to On-Screen Marking and described the wider system as secure. The hacker's account of a master password and 45 flaws has not been confirmed by CBSE or by an independent audit.
- What did the hacker say he could access? He says he used a physics teacher's account to grade sheets, later reached a large volume of scanned answer sheets, and viewed question paper URLs. Those are claims from one interview, not verified findings.
- Is an ethical hacking report legal in India? Reporting a flaw to a vendor is the intended path, and the hacker says he chose that path first. Publishing proof of unauthorised access to a system can carry legal risk, and no law creates a safe harbour for reaching data during testing.
- Did the exposure violate the DPDP Act? The hacker argues it did. India's Digital Personal Data Protection Act, 2023 governs personal data handling and requires breach notification, but no authority has ruled on this case.
- What would resolve the dispute? An independent audit of the evaluation portals, a public incident timeline, and disclosure of whether any marks or sheets were altered. None of these has been released as of October 2026.
- Could question papers leak before exams? The hacker says the URLs were visible and raises the possibility, but he does not claim to have seen a private leak. No reported paper leak is part of the record.
- Why does the case matter outside CBSE? Concentration of exam data in one portal recurs across boards, universities and testing agencies. The design risk, a single credential for many functions, transfers wherever evaluation is digitised.
- What did the hacker want from the board? He describes wanting a direct reply and access to a researcher channel. Much of his criticism concerns process, particularly the boilerplate responses he says he received.
- Who was the intermediary? The hacker describes sending reports through an organisation he calls a middleman and receiving formulaic replies. The transcript names it, but this article could not verify the organisation or its role in 2026.
Turning evidence into a report you can read
Disputes like the CBSE case show how much depends on the strength of the reporting around a claim. The hacker's account matters because it is specific and dated, even where CBSE disputes it. A reader following a security story needs those specifics kept intact.
If you record interviews, explainers or breaking stories on YouTube, the same wording often stays locked in the video. Skalablog turns a video URL into a transcript and then into a structured article, so a single interview can become a page people can find and cite.
Bring the video, let Skalablog produce the draft, then edit it with the same care you would give any report. The tool handles the transcription and structure; the judgment about what is claimed and what is proven remains yours.
Turning a video interview into a citable article
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits