Seventeen million. That is how many times India's vehicle records in VAHAN, SARATHI, e-Challan and PUCC were queried through privately held credentials between January 2024 and September 2026, according to the first official accounting of the practice, obtained under the Right to Information Act, 2005. The figure arrived from the National Informatics Centre on 16 October 2026, nine days after the Ministry of Road Transport and Highways quietly ended the arrangement that made it possible - and more than three weeks after the same Ministry answered a citizen's questions about that very arrangement by pointing to a webpage.
A system opened, then closed without explanation
The numbers themselves are striking: 338 credentials recorded for private entities against 62 for government bodies, and 25,314 credentials issued to private parties over the period in question - a gap NIC's reply does not explain. One plausible reading is that the larger figure is cumulative, covering renewals and lapsed access, while the smaller is a snapshot taken after sharing was discontinued. NIC's reply states, almost as an aside, that "the arrangement for sharing information with private entities was discontinued with effect from 01.10.2026 pursuant to the directions of MoRTH." No public order, notice or press statement documents that decision. MoRTH, which issued the direction and alone holds the names of the entities involved, answered none of the twelve detailed questions put to it, disposing of the application within two days with generic references to the Motor Vehicles Act and a data-sharing policy posted online.
A pattern going back to 2019
This is not the first time India's vehicle databases have been opened to commercial access. Under a Bulk Data Sharing Policy introduced in March 2019, dozens of private companies - banks, insurers, manufacturers - paid for access to VAHAN and SARATHI records, generating more than ₹111 crore in disclosed revenue by 2021. That policy was withdrawn in June 2020 following privacy concerns, but the data already sold remained in circulation, since no deletion was ever mandated. A new channel, the Policy for Data Sharing from the National Transport Repository, was circulated in August 2025, reopening API and bulk access to banks, insurers and "transport service providing agencies" under Aadhaar-linked consent - an executive circular with no statutory footing, no public register of recipients, and a clause granting law enforcement unrestricted access to personal data.
Monthly volumes fell as scrutiny grew
Query volumes tell their own story. From January 2024 through July 2025, monthly lookups averaged nearly 700,000. They then fell sharply - to roughly 452,000 in August 2025, 278,000 in September, and under 240,000 in October - settling at an average of about 262,000 a month through September 2026, the lowest point in the entire series. The decline begins in the same month the NTR Policy was circulated, and coincides with a spike in cybersecurity reports reaching NIC. Whether these are connected is not something either agency has clarified.
Logs disappearing faster than answers arrive
Perhaps the most consequential disclosure concerns retention. NIC keeps API logs for one year, SMS logs for six months, and database logs on an undefined "ongoing basis." A Telegram operation selling live VAHAN records, investigated by the security firm Cyderes and reported to CERT-In in June 2026, ran from September 2025 with request logs into April 2026 - meaning the SMS trail for that entire window has already lapsed, and the API trail will vanish in stages through April 2027. Asked directly whether it had received the CERT-In disclosure and what followed, NIC's answer was that action taken and any revocation date "are not specified in the inputs presently available." No instruction to preserve logs appears to have been issued. A first appeal against MoRTH has been filed, and one against NIC is underway - but the commercial app that prompted this inquiry, offering owners' addresses, financier details and engine numbers for ₹29, remains available for download.