COEMPT Engineers Allegedly Processed CBSE Student Data with Google Gemini
An ethical hacker alleged that COEMPT Eduteck, which operates the CBSE's exam platform, used Google Gemini to process sensitive Indian student data in quality assurance automation scripts. The hacker also claimed that unprotected AWS buckets containing millions of rows of student data and exam materials were publicly accessible, potentially violating data privacy laws.
What happened
Ethical hacker Nisarga Adhikary alleged that COEMPT Eduteck, the CBSE's technology vendor, processed sensitive student exam data including personal information with Google's Gemini in automation scripts prepared by quality assurance engineers.
Adhikary claimed that a public AWS bucket contained 2026 answer sheets and question papers accessible without authentication, and that COEMPT stored the data in public AWS buckets without security checks rather than on their own servers.
Reported impact
Adhikary stated that the CBSE's On-Screen Marking platform contained 9.3 million columns and rows of sensitive student data, including images of answer sheets, that lay unprotected and could be easily tampered with.
Adhikary alleged that sensitive student data was sent to the United States for processing by a third party, stating this violated data privacy laws.
Index analysis
The incident involves the processing of Indian students' personal information and exam data by Google's Gemini AI system through COEMPT automation scripts without apparent consent or appropriate safeguards.
Governance controls
CBSE stated in an official response that identified vulnerabilities in the OnMark portal had been contained and that government cybersecurity professionals and IIT experts had been deployed to fortify systems and move them to more secure infrastructure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.