The Registry That Called Everyone: 265 Million Numbers Exposed at India's DND

Verdict: Two Apache CouchDB 2.3.1 instances — the world-state database backing India's TRAI-mandated National Do Not Call (NDNC) registry — were reachable by any anonymous internet user with zero authentication, exposing roughly 265 million records: the complete national Do-Not-Disturb preference database, consent ledgers, telemarketer blacklists, and — in one small index — full residential PII including names, dates of birth and phone numbers.

Reported to CERT-In through responsible disclosure. All network indicators and all personal data are redacted here; the point of this post is the failure mode, not the dataset.

#The exposure

India's DND framework works like this: consumers set preferences about which categories of telemarketing they'll tolerate, carriers record those preferences, and a national registry enforces them. The registry's state database ran on Hyperledger Fabric v2.x with Apache CouchDB 2.3.1 as the world state backend — two nodes, a primary and a mirror, serving identical data from a major public cloud provider's address space.

Both nodes listened on the standard CouchDB port with Admin Party still in effect — CouchDB's term for "no administrators configured, everyone is root." No auth proxy sat in front. No network ACL restricted access. The most recent probe, in July 2026, confirmed both nodes still open with ~265 million records served to unauthenticated callers.

#What was inside

#The index that shouldn't have existed

The small one was the worst one. The UTM blacklist index — 8,666 records of individuals who had apparently been flagged for SMS abuse — carried full residential dossiers. The record shape:

{
  "adr": "[REDACTED — full residential address: street, area, city]",
  "cty": "[REDACTED — city]",
  "pin": "[REDACTED — postal code]",
  "utmfn": "[REDACTED — first name]",
  "utmna": "[REDACTED — full name]",
  "utmdob": "[REDACTED — date of birth, DD-MM-YYYY]",
  "utmno": "[REDACTED — phone number, +91 format]"
}

Name, father's-name context, street-level address, date of birth, phone number — a complete identity package per person, sitting in a database anyone could GET.

#How it was verified

# CouchDB greets an anonymous caller with its version banner
curl -s http://REDACTED-IP:5984/

# 245 million DND preferences, no credentials
curl -s http://REDACTED-IP:5984/preferences_preferences

# Sample the UTM blacklist — the PII index — with full documents
curl -s 'http://REDACTED-IP:5984/utmblacklist_utmblacklist/_all_docs?include_docs=true&limit=3'

# Operator complaint channels
curl -s http://REDACTED-IP:5984/taaichannel_complaints

# Internal metadata endpoints, also open
curl -s http://REDACTED-IP:5984/meta/_all_docs?include_docs=true

CouchDB is particularly generous when unauthenticated: _all_docs?include_docs=true is a bulk export API. An attacker doesn't need queries — the database hands over complete documents, one scroll at a time.

#Why this matters

The national spam shield became a spam list. The preferences_preferences table is the definitive map of which phone numbers belong to which carrier and which marketing categories they've opted into — 245 million of them. Whoever holds it knows exactly who to call, on which network, with what cover story.

Consent records enable identity linkage. Seven million consent rows with hashed identifiers and operator attribution are a ready-made correlation table: hash a candidate phone number, look it up, and attach carrier, consent history, and category preferences to it.

Complaints mark the vigilant. 740,000+ DND complaints identify precisely the consumers who report spam — the people most likely to recognize and resist a social-engineering call, and the ones a smarter adversary would either avoid or target first.

Blacklisted entities leak the other side of the ledger. 390,000 blacklisted telemarketing entities with audit trails — the enforcement record of the registry itself — becomes a targeting guide: who's been chased, by whom, for what.

And the small index is identity theft with a postal code. Full name plus DOB plus street address plus phone is the exact bundle resold in every SIM-swap and account-takeover kit.

Moral: A registry that exists to protect 245 million people from unwanted calls had, for years, nothing between those people' data and the open internet but a default configuration. Defense systems deserve more hardening than the things they defend — not less. The firewall for the national "do not disturb" list was, quite literally, set to "do not authenticate."

#What the operators should do

Immediately:

• Firewall both CouchDB nodes to the Fabric peers' network only — the world-state DB should never answer a public GET
• Create real admin credentials and kill Admin Party on every cluster node
• Rotate anything the exposed nodes could reach — Fabric channel configs, TLS material, operator API keys

Short term:

• Re-architect CouchDB auth (LDAP/PAM or built-in admins) and put mutual TLS between peers and state DB
• Reassess the Hyperledger Fabric deployment's whole threat model: a chaincode platform whose state DB is public is a public database with extra steps
• Purge or justify the UTM blacklist index — a spam-blocklist has no business carrying DOBs and home addresses

Long term:

• Independent security assessment of the NDNC registry and every contributor integration
• Continuous external attack-surface monitoring: two open CouchDB ports on a cloud provider are trivially findable by scanners that never sleep

#Disclosure

Reported to CERT-In via responsible disclosure by an independent researcher. Both nodes were confirmed open as of the most recent probe (July 2026); remediation status unknown at time of writing. No phone numbers, names, addresses or IPs from the exposure are reproduced in this post.

Moral of the fable: the database meant to quiet 245 million phones was itself shouting — on an open port, to anyone listening.