Chandan Kumar, 52, a senior executive working with a multinational company in Mumbai, has been arguably the biggest known victim of cyber hacking in India till date. His social media accounts, phone numbers, debit and credit card numbers, Aadhaar, and passport have been hacked since October 2021. A police complaint and hiring of an ethical hacker to trace the unknown hacker have not yet proved fruitful.
Kumar comes from an affluent family. He worked with leading international banks and lived in London and Singapore for eight years before returning to India. Today, the life of his family, which comprises of his wife Mausumi, a daughter, and a son, has turned into a nightmare. The Kumars have not only lost privacy but their sleep too.
“Calls are automatically being made from my and my wife’s numbers. Several applications are being installed automatically,” said Kumar, a resident of Navi Mumbai. “The hacker has total control over our mobile phone, emails, and social media accounts. We have become his puppets; we are helpless. We are reduced to mute spectators only.”
Also read | Hacker group that targets Indian military, government found using new Android trojan to hack cameras and mic
The hacker manages to call Kumar’s relatives and friends numerous times a day, creating a false impression that Kumar or Mausumi are calling them. Once a phone call or WhatsApp voice is answered, the hacker does not say anything. When at home, Kumar can watch Mausumi calling his number when she is busy with her household work and did not actually call him.
On February 25, when they were planning to celebrate their wedding anniversary, the hacker spoiled their plan by calling almost everyone on their contact list. The people in turn called the Kumars to inquire what the matter was. “He even made WhatsApp calls to family members in the US and to my sister-in-law, who stays in Jharkhand when my phone was on airplane mode. The hacker switched off the airplane mode. He switched on the wi-fi and installed Kasamba, an application, and was typing OTP (one-time password) in front of my eyes. He is able to read, write and hear everything I say,” said Kumar.
On several occasions, the hacker booked hotel rooms in Australia, Thailand, Switzerland, and Indonesia in Kumar’s name. He realised that only when he received a booking confirmation by email. The hacker orders food and other items in his name from online shopping sites with the ‘cash on delivery option. The Kumars are fed up of telling the delivery boys that they have not ordered anything.
The hacker had also sent applications for five jobs, including that of an office assistant to the global head of a multinational company headquartered in London, compromising Kumar’s LinkedIn account.
Also read | Karnataka Bitcoin Scam: Meet ‘Big Boss’ Srikky, the hacker who hoodwinked police
Kumar changed his iPhone and the SIM cards twice. He even purchased an Android phone suspecting that the iPhone might have some technical issues. He bought new SIM cards by submitting documents of his friends so that his identity is not revealed.
All these efforts failed as the hacker managed to get hold of each of mobile handsets and SIM cards. Kumar also hired an ethical hacker a couple of months ago to trace the hacker and secure his phones. All was in vain. “The hacker has started calling the ethical hacker and irritating him,” says Kumar.
Chandan Kumar said it all began in October 2021 after he booked a ticket from a travel website. He said he neither opened any suspicious link on his phone or email nor gave access of his handset to anyone. “It is a mystery how the hacker got hold of my gadgets. My WhatsApp has been hacked. SMS and phone calls are being made from latest phone automatically. Two applications, Astrotalk and Astroyogi are automatically installed without my permission even after deleting them several times.”
The hacker had sent a message to Mausumi’s friends from her phone saying she was in Malaysia and desperately needed money. The hacker asked them not to call her. When some relatives called Kumar to know what the matter was, it became clear that Mausumi’s phone was compromised too.
Kumar filed a complaint with the Navi Mumbai police on November 3, 2021. The hacker started threatening to kill his family soon after.
The hacker created a WhatsApp group and added Kumar’s acquaintances in London and Singapore. The hacker posted obscene messages in the group. He did not stop there. He applied for a loan on Kumar’s behalf. Then the bank officials started asking Kumar to submit documents to get the loan.
The police were not yet able to trace the hacker. Kumar had also approached Apple India for help. “We all get scared when the mobile rings,” said Kumar. “We are unable to sleep properly. My case is a big challenge for the cyber security experts and the police as well.”
A senior police officer from Maharashtra police’s cyber security cell says Kumar’s case was unique. He said the serious part was the origin of the hacking has remained untraced. “In a normal case, we could locate the hacker. In this case, it is strange that the hacker has managed to compromise every single gadget Kumar is using.”
Kumar said the hacker’s motive is to harass him. “He has not put any demand yet. He has not communicated with me. If he does, I will come to know what he wants.”