Search
Breach tracker

Breach report

CBSE contains marking-portal flaws after first denying researcher's claims

ConfirmedDisclosed Updated IndiaEducationBy Vivek Kumar
Records UnknownCause Vulnerability
Conceptual illustration: Anonymous exam marking sheets and an educational computer screen with a protective patch plate over a digital fracture. Headline: CBSE PORTAL SECURITY.

AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.

A student researcher showed admin access to CBSE's vendor-run On-Screen Marking system. CBSE denied it on 26 May, then said on 1 June the vulnerabilities were contained.

What happened

CBSE evaluated 2026 answer books through an On-Screen Marking (OSM) system run on a service provider's OnMark platform. In late May, a Bengaluru-based researcher who had just finished Class 12 posted evidence of access to the system. MediaNama reported on 30 May that the researcher demonstrated super-admin access on evaluation subdomains and claimed access to production servers, and had flagged issues to CERT-In months earlier.

Confirmed vs. claimed

Denied, then acknowledged: on 26 May, CBSE said on X that the URL in the social media post was a testing site with sample data only, and that the portal used for real evaluation was neither compromised nor vulnerable, ANI reported. On 1 June, CBSE said it was monitoring vulnerabilities in its service provider's OnMark portal, that the identified vulnerabilities had been contained, and that experts from government agencies and IITs were securing the systems.

Not established: CBSE has not said that any marks were changed, and no source we read shows that they were. How much student data was reachable has not been disclosed.

Who is affected

Class 12 students whose answer books were evaluated through OSM, and evaluators with portal accounts. CBSE has not published a count of exposed records.

What to do

  • If your marks look wrong, use CBSE's official re-evaluation process on cbse.gov.in only.
  • Ignore anyone offering to "fix" marks for money. That is a scam.
  • Evaluators: change your OSM password and any reused passwords.
  • If you lose money, call 1930 or report at cybercrime.gov.in as fast as you can; see our 1930 guide.

Sources

We do not link to leak sites or reproduce leaked data. Spotted an error? Request a correction.

More breaches in India