Toll Plaza Data Exposure

Cyble Research Labs discovered a publicly exposed website containing XML files of FASTag toll transactions (27 Aug 2021–27 Dec 2021) for an unidentified toll plaza; the files include plaza IDs, vehicle tag IDs, vehicle registration numbers, vehicle class and digital signature details. The exposure is assessed as a third-party data leak that could enable social engineering and privacy/operational risks; recommended mitigations include monitoring public-facing assets, API authentication, regular VAPT, and strict IAM.