Cybersecurity & Compliance
Rs 110–125 Crore NICSI Messaging Deal Under Govt Review Following Bogus Certification Allegations
NEW DELHI: The government has initiated a review of documents submitted for a Rs 110–125 crore annual contract recently awarded by the National Informatics Centre Services Incorporated (NICSI) for SMS and messaging gateway services, following allegations that the winning vendor, OneXtel Ltd., may have submitted invalid or fraudulent certification.
Background of the Contract
In January 2026, OneXtel Ltd. was empaneled by NICSI to provide messaging services for central and state government departments, public sector undertakings, and autonomous bodies. The contract, initially spanning three years with a possible two-year extension, was expected to generate annual revenue of Rs 110–125 crore. Services under the contract include OTP-based authentication, transactional alerts, public awareness campaigns, emergency notifications, and Rich Communication Services (RCS).
NICSI, operating under the Ministry of Electronics and Information Technology (MeitY), manages government messaging infrastructure critical to large-scale citizen communication.
The Certification Controversy
The contract came under scrutiny after a whistleblower alleged that OneXtel submitted a CMMI Level 5 certification issued by UK Certification & Inspection Limited, a body not authorized by the CMMI Institute (now under ISACA) to grant such appraisals.
CMMI (Capability Maturity Model Integration) Level 5 is the highest maturity rating, indicating optimized and continuously improving processes, and serves as a key eligibility criterion for government tenders involving critical infrastructure. Only CMMI-authorized Lead Appraisers can issue valid certifications, which are publicly verifiable via the Published Appraisal Results System (PARS).
According to the complaint, neither OneXtel Ltd. nor the issuing body appears in the official CMMI partner registry or on PARS, raising questions about the certificate’s validity.
Official and Expert Insights
A senior bureaucrat, speaking on condition of anonymity, told The420.in that certifications like CMMI Level 5 are crucial for ensuring operational reliability, privacy protection, and legal compliance in government communications. Accepting an invalid certificate compromises procurement integrity, and agencies are expected to verify appraisals independently.
The officer likened reliance on unverifiable certifications to allowing someone with a fake driving license to operate a vehicle—posing legal and operational risks. Corrective actions in such cases can include disqualification, cancellation of empanelment, withholding purchase orders, or temporary debarment.
OneXtel’s Troubled Past
This probe follows previous regulatory action. In July 2024, the Department of Telecommunications (DoT) suspended OneXtel and another telemarketer, V-Con, for sending 55.5 million fraudulent or phishing SMSes to smartphone users. The suspensions followed complaints lodged on the Chakshu portal regarding malicious messaging practices.
Next Steps
The ongoing review focuses on verifying the authenticity of the CMMI certificate and assessing due diligence conducted during the empanelment process. If the allegations are substantiated, the findings could lead to contract reassessment and strengthen scrutiny of certification verification procedures in government procurement.
At the time of reporting, neither NICSI nor OneXtel Ltd. had issued an official statement regarding the complaint or the government review.
Cyber & Financial Fraud
Maldives Consul Hit By Credit Card Fraud During Flight, Authorities Examine Possible Data Breach Or Insider Role
The Maldives Consulate is investigating a credit card fraud incident involving one of its officials while in transit, authorities confirmed on March 28, 2026. The case has prompted inquiries into whether the breach stemmed from a data leak or involved internal complicity.
The incident reportedly occurred during a flight, when the consul’s payment details were allegedly compromised. Officials have not yet disclosed the exact method of the fraud but are examining all potential vectors, including unauthorized access to travel-related systems or insider involvement.
Local and international law enforcement agencies are collaborating with the Maldives Ministry of Foreign Affairs and relevant banking institutions to determine the scope of the breach and mitigate potential financial damage. “We are conducting a thorough investigation to ensure accountability and prevent future incidents,” a spokesperson said.
Experts warn that such in-flight frauds, while rare, can exploit vulnerabilities in wireless payment systems, mobile banking apps, or compromised devices. Travel security protocols are being reviewed across diplomatic missions to strengthen protections against similar threats.
No arrests have been made, and the investigation is ongoing. Authorities have advised travelers and officials to remain vigilant about unusual activity on financial accounts and report any suspicious transactions immediately.
Cybersecurity
Critical Google Chrome Zero-Day Vulnerabilities Put 3.5 Billion Users at Risk; Immediate Update Urged
Google has issued an urgent security advisory for its Chrome browser after identifying two critical zero-day vulnerabilities, tracked as CVE-2026-3909 and CVE-2026-3910. These flaws could allow hackers to exploit the browser before patches are widely applied, putting an estimated 3.5 billion users worldwide, including those in India, at potential risk.
Why Chrome Is a High-Value Target
As the world’s most widely used web browser, Chrome is a primary target for cybercriminals. Browsers act as the gateway to internet activities such as online banking, email, and web applications. Exploiting vulnerabilities at this level can enable attackers to steal sensitive information, hijack sessions, or deploy malware without the user’s knowledge.
A 2025 report by Omdia for Palo Alto Networks revealed that 95% of cyberattacks originate from employee devices, emphasizing the high-risk nature of browser-level vulnerabilities.
Expert Warnings on Zero-Day Exploits
Cybersecurity specialists have raised alarms that these zero-day flaws could be leveraged for session hijacking, phishing attacks, and bypassing multi-factor authentication, potentially compromising user accounts despite advanced security measures.
“Hackers increasingly focus on browsers as entry points,” said a cybersecurity analyst. “Exploiting these vulnerabilities provides direct access to sensitive data and session tokens, making prompt updates critical.”
Google’s Advisory and Immediate Actions
Google has released a security update that addresses both vulnerabilities and strongly urges all Chrome users to install the latest version immediately. The company has withheld detailed technical information to prevent misuse by malicious actors until most users have applied the patch.
Cybersecurity experts recommend the following precautions:
- Update Chrome immediately to the latest version.
- Enable automatic updates to receive future security patches promptly.
- Avoid clicking suspicious links or attachments in emails or messages.
- Monitor accounts regularly for unusual activity and report potential compromises.
Global Implications
The alert highlights the growing importance of browser security in a world increasingly reliant on digital services. Organizations and individuals are urged to adopt proactive measures, including regular updates and cautious online behavior, to mitigate risks associated with zero-day vulnerabilities.
Google continues to monitor the situation and has assured users that it is taking steps to maintain robust security across its platforms. Timely updates remain the most effective defense against these emerging cyber threats.
Cybersecurity
UAE Orders Action Against 35 People, Including 19 Indians, for Spreading AI-Generated Fake Videos Amid Iran War
Amid rising tensions in West Asia over the ongoing Iran-related conflict, the United Arab Emirates has taken stringent action against individuals accused of spreading misleading or AI-generated videos on social media. Authorities have ordered the detention of 35 people, including 19 Indian nationals, for circulating fabricated or altered clips that fueled public panic and misinformation.
Accused Divided Into Three Groups
Investigations revealed that the suspects operated in three distinct groups:
- Edited Real Footage: The first group allegedly recorded real missile interceptions and drone activity, then manipulated the clips with added sound effects, dramatic commentary, and visual enhancements to exaggerate the threat and create fear among the public.
- Fully Fabricated Content: The second group reportedly used artificial intelligence to create entirely fake videos or reused footage from incidents in other countries, falsely presenting them as events in the UAE. These videos often showed explosions, fires, or missile strikes, accompanied by national flags or dates to appear authentic.
- Propaganda Posts: The third group allegedly circulated content glorifying a “hostile state” and its military actions while promoting narratives harmful to UAE’s national interests and stability.
Previous Arrests and Expanded Investigation
Earlier this month, 10 individuals, including two Indians, were arrested in a related case. Continued monitoring and digital forensics led authorities to identify additional suspects, bringing the total to 35. Some videos were specifically crafted to exploit children’s emotions or falsely depict major security threats in urban areas.
National Security Concerns
Officials emphasized that sharing videos showing missile trajectories or drone interceptions could compromise sensitive defense information. Such content might be exploited by hostile actors to analyze the UAE’s defense systems or to propagate false narratives. Authorities have since intensified digital monitoring and enforcement measures.
Legal Consequences Under UAE Law
Under UAE law, spreading false information or digital content that threatens national security or public order carries a minimum prison sentence of one year and fines starting at AED 100,000 (approximately ₹22 lakh). Authorities have warned that strict action will continue against anyone attempting to exploit the ongoing conflict for misinformation purposes. Citizens are also urged to verify the authenticity of any content before sharing online.
-
Business3 years agoPot Odor Does Not Justify Probable Cause for Vehicle Searches, Minnesota Court Affirms
-
Business2 years agoNew Mexico cannabis operator fined, loses license for alleged BioTrack fraud
-
Business2 years agoAlabama to make another attempt Dec. 1 to award medical cannabis licenses
-
Business3 years agoWashington State Pays Out $9.4 Million in Refunds Relating to Drug Convictions
-
Business2 years agoMarijuana companies suing US attorney general in federal prohibition challenge
-
Business3 years agoLegal Marijuana Handed A Nothing Burger From NY State
-
Business3 years agoCan Cannabis Help Seasonal Depression
-
Blogs3 years agoCannabis Art Is Flourishing On Etsy
