ICAR data breach: Head of institute replaced 3 days before end of term

The Indian Express first reported in July about the data breach and that a six-member inquiry committee had been set up following a directive from Union Minister Shivraj Singh Chouhan.

On October 6, an official directive named a new director for the Indian Agricultural Statistics Research Institute (IASRI) — which functions under ICAR and hosts its data centre — “consequent upon the curtailment of tenure” of Rajendra Prasad who was originally slated to hold charge till October 9.

“…the Competent Authority has decided that Dr Kairam Narsaiah, Assistant Director General (Process Engineering)… shall hold the additional charge…as an interim arrangement”, the ICAR order stated.

When asked by The Indian Express whether his removal was due to the data breach, Prasad said, “I don’t know, ask them (the authorities).”

Besides, Principal Scientist Sudeep Marwaha, who headed the Division of Computer Applications at Delhi-based IASRI, has been shifted to Central Institute of Agriculture Engineering (CIAE) in Bhopal. When contacted, Marwaha told The Indian Express, “I have joined in Bhopal. My transfer order shows it was for administrative reasons…my role at the Data Centre was limited. Much of the role was that of the IT unit.”

Sources said another Principal Scientist, K K Chaturvedi, who was heading a dedicated IT Unit under Prasad, has been shifted to the ICAR headquarters. Chaturvedi did not respond to calls from The Indian Express seeking comment.

Inaugurated in December 2016, the data centre at IASRI provides the tech infrastructure for hosting web applications developed by ICAR institutes across the country. IASRI’s IT Unit was created “to manage all ICT (Information & Communication Technology) related work of development, implementation and operational management” in ICAR. It ran parallel to the institute’s Computer Applications division with both heads reporting to Prasad.

When contacted, ICAR Director-General and Department of Agricultural Research and Education Secretary, Mangi Lal Jat, said, “Let me put it on record that ICAR is committed to ensuring the security of its data in the larger national interest. A high-level committee was constituted to assess the data issue due to a cyber attack in March 2025. The committee has submitted its report and accordingly necessary steps are being taken by the concerned divisions of ICAR.”

According to sources, the committee submitted its report in mid-August detailing the alleged negligence that caused the breach, which also affected the ICAR’s website, its server in Delhi and its replication server at the National Academy of Agricultural Research Management (NAARM) in Hyderabad.

CERT-In (Computer Emergency Response Team) has also initiated an inquiry over the breach, the sources said. “A bulk of data was removed from the main server and the replication server, which is a serious matter,” sources said.

Dr D K Yadava, ICAR’s DDG (Crop Sciences), who headed the inquiry committee, did not respond to calls from The Indian Express seeking comment.

The affected data is understood to be mainly related to Agricultural Scientists Recruitment Board (ASRB) and NAARM, apart from IASRI, all of which function under ICAR.

Sources had told The Indian Express earlier that the data was “related to recruitment, from Technical Officers to Deputy Directors General (DDG), and job applications sought last year”, and “covers a large number of projects and related information submitted by scientists online and preserved in repositories”, including “email communications”.