JEE Advanced: IIT Roorkee denies data leak claims, calls reports misleading

X user Rylen Anil shared that IIT Roorkee's Google Cloud storage portal exposed candidate's data without authentication.

Days after a Dubai-based student flagged a security vulnerability in the Joint Entrance Exam (JEE) Advanced 2026 results infrastructure, the Indian Institute of Technology (IIT) Roorkee has issued a detailed clarification denying claims that the personal data of lakhs of candidates was leaked.

In a statement released on Thursday, June 5, IIT Roorkee said reports and social media posts alleging a "data breach" and "privacy violation" affecting JEE (Advanced) aspirants were "misleading and factually incorrect".

"The information circulating on social media is misleading and does not accurately reflect what happened. There is an attempt at spreading misinformation, which is far from the truth," the institute said.

The clarification comes days after a student cybersecurity researcher, Rylen Anil, reported a cloud-storage configuration issue in the JEE Advanced 2026 results system and claimed that candidate records and admit-card files could be accessed without authentication.

What IIT Roorkee has said

According to IIT Roorkee, the issue arose on June 2 when technical interventions were undertaken to assist candidates who were facing difficulties accessing admit-card data and registration-related services.

The institute said these interventions resulted in a "minimal, temporary misconfiguration" in a cloud-storage component.

IIT Roorkee confirmed that Anil identified the issue and reported that he was able to access the affected database.

However, the institute maintained that the issue was rectified immediately after being reported.

"The issue was immediately rectified and access to the data was restricted," the statement said.

The institute further asserted that the affected storage system was configured as "read only", meaning no records could be modified, altered or deleted.

'No bulk download occurred'

One of the central claims made in IIT Roorkee's clarification relates to the scale of access.

The institute said an analysis of cloud-access logs found no evidence of any mass download of candidate information.

According to the statement, the read-only access was limited to "less than 0.05 per cent of the data".

"An analysis of cloud access logs confirmed that no bulk download occurred. No sensitive information was compromised or mass-extracted," IIT Roorkee stated.

The institute also emphasised that the incident had "zero impact" on examination outcomes, including candidates' marks, ranks and category details.

Student hacker also issues clarification

In a separate statement posted on social media on June 5, Anil also cautioned against exaggerated claims regarding the incident.

"I have noticed claims saying all JEE candidate data was leaked. While there was a vulnerability, I have not seen evidence supporting claims of a large-scale leak," he wrote.

The student further noted that the issue had been reported responsibly and addressed promptly by IIT officials.

Anil also clarified that he had downloaded only a limited number of files to verify the vulnerability and had deleted them afterwards.

"I only downloaded a small number of files for verification purposes and deleted them afterwards. This is a serious matter and should not be used to make unfounded claims or spread misinformation," he wrote.

What was the original claim?

The controversy began shortly after IIT Roorkee declared JEE Advanced 2026 results on June 1.

Anil had reported that a Google Cloud Storage bucket linked to the JEE Advanced results infrastructure had been configured in a way that allowed unauthorised access without authentication.

In a social media thread, he claimed that approximately 1.79 lakh candidate-result records and nearly 1.87 lakh admit-card PDF files were potentially accessible through the misconfigured storage system.

He stated that the exposed files contained information such as candidate names, dates of birth, mobile numbers, examination scores and ranks.

Following the disclosure, IIT Roorkee publicly acknowledged the configuration issue and thanked the student for reporting it.

At the time, the institute had stated that the storage was configured in a read-only mode and that there was no possibility of data alteration.

JEE Advanced 2026

JEE Advanced is the second stage of India's engineering entrance examination process and serves as the gateway to admission into the Indian Institutes of Technology (IITs).

The examination was conducted by IIT Roorkee on May 18, 2026, and the results were declared on June 1.

More than 54,000 candidates qualified the examination this year and are currently participating in the Joint Seat Allocation Authority (JoSAA) counselling process for admissions to IITs, National Institutes of Technology (NITs), Indian Institutes of Information Technology (IIITs) and other participating institutes.