Koo leaking users’ data, says hacker who alleged flaws in Aadhaar, Aarogya Setu

In 2018, the name 'Elliot Alderson' was in the headlines in India routinely. Alderson was the pseudonym adopted by a French hacker. In January 2018, Alderson, who uses the Twitter handle fs0c131y, began tweeting on the alleged security flaws in the Aadhaar database.

In 2020, Alderson took on a new target: The Aarogya Setu app mandated by the Centre to track the spread of COVID-19. Alderson claimed Aarogya Setu had security flaws. In May 2020, Alderson tweeted "A security issue has been found in your app. The privacy of 90 million Indians is at stake…" Not surprisingly, in both cases—of Aadhaar and Aarogya Setu—the government vehemently denied Alderson's claims.

Now, Alderson has targeted the latest 'rage' on social media: The desi Twitter alternative called Koo. On Wednesday, Alderson tweeted that he had been requested by Twitter users to test Koo. Early on Thursday, Alderson shared screenshots of what appeared to be the developers' code for Koo. He alleged Koo was "leaking of the personal data of his users: email, dob, name, marital status, gender..." The screenshots Alderson shared were purportedly of a female user and the details mentioned include marital status and email (which he redacted).

Alderson also shared a screenshot of the domain details of Koo. It showed the geolocation as the US and the registrant as Tao Zhou, based in Jiangxi, China. On Wednesday, Aprameya Radhakrishna, co-founder and CEO of Koo, told CNBC that a Chinese investor, Shunwei Capital, had invested in the company, but was in the process of exiting.

Alderson also tweeted Koo had experienced an outage on Wednesday.

Koo has been in the headlines ever since Union ministers began embracing it, amid the government's standoff with Twitter.