ICAI Says No Data Breach Despite Viral Website Message and Social Media Claims

Data Breach Notification on ICAI BOS Portal

Most recently, social media again erupted with ICAI data breach allegations after a notification on the official BOS LIVE portal of ICAI hinted at it. The notification clearly stated that the ICAI data was breached and a threat named “zowico” had compromised ICAI’s systems. The notification was published on ICAI’s official website before being taken down after few hours. This looked like an attempted hack took as the post was nowhere close to ICAI’s normal notifications.

The notification in question here read, “The result of the Chartered Accountants Examination held in May 2026 was declared earlier because all of our websites including examiners portal where we store students marks and answer sheets and was used for allocating marked was targeted by threat actor named zowico https://boslive.icai.org/announcement_details.php?id=593.”

It may be noted that for all of students critical data has been breached, members data is also leaked. We have sent notices to influencers which tried to tell the truth that our websites are hacked, but unfortunate truth is that all of our websites are hacked. No one is safe. We taking down posts, so truth cannot come out and we cant be held responsible. We as Institute have no responsibility of safety of your private data that you handed over to us. We wont take any responsibility of breached data. We will take down as many posts as possible so truth cant come out. All hail zowico. We beg you dont let truth come out.” This post was later removed from the ICAI’s BOS Knowledge portal.

ICAI Data Breach Allegations - Where did it all begin?

This is not the first time allegations of a possible data breach at ICAI have surfaced online. Before the announcement of ICAI results for the May 2026 session, a social media post from an X user named “DarkWebInformer” hinted at a possible leak. The post talked about a claim that the ICAI examiners' portal had been compromised and students' and members’ data was leaked. The post further had a link to another website with more details about the cyber attack (https://indianbreaches.com/breach/institute-of-chartered-accountants-of-india-icai-14-june-2026). As of now, the link is not working, and no information about the said claim is available on the website.

DarkWebInformer posted on X, “A threat actor known as zowico is claiming full RCE and superadmin access to the ICAI examiners portal (http://examiners.icaiexam.icai.org), the examination system of the Institute of Chartered Accountants of India, alleging 200K+ records.

Allegedly compromised access/data includes:

• Full remote code execution and superadmin control of the portal

• Answer sheets of all students who appeared in May 2026

• Ability to modify marks per question and on full papers

• Examiner profiles

• Marking schemes

The actor claims it isn't being sold and provided a sample link. Claim is unverified.”

ICAI Issues Clarification on Data Breach Speculations

Amid all the data breach allegations, ICAI issued a clarification on all its social media platforms, claiming that the post circulating online is fake and malicious. ICAI further clarified that there has been no breach in its data and it remains committed to protect all kinds of students and members’ data.

ICAI’s clarification read, “ICAI has come across certain posts circulating on social media alleging breach of members'/ students' records and examination data. These claims are completely false, baseless and malicious. ICAI assures all its stakeholders that there has been no breach of members'/ students' records and examination data whatsoever as alleged or otherwise.

All stakeholders are requested not to give any credence to such false and malicious propaganda on social media platforms. ICAI has in place robust systems to protect all kinds of data and remains committed to maintaining the highest standards of data security and urges all stakeholders to rely and refer to its official communication channels only for authentic announcements.”