NEW DELHI: IIT Roorkee has pushed back against reports of a large-scale data breach involving JEE (Advanced) 2026 candidates, saying claims circulating on social media are “misleading and factually incorrect” and do not accurately represent what occurred.The clarification comes days after cybersecurity researcher Rylen Anil reported a cloud storage misconfiguration linked to JEE (Advanced) infrastructure and claimed that candidate-related records and admit card PDFs were accessible without authentication. The issue had drawn attention amid a series of cybersecurity concerns involving education-related digital platforms, including CBSE’s On-Screen Marking (OSM) system and the NTA re-examination portal.Now JEE Advanced 2026 data exposure claim puts IIT Roorkee in focus after CBSE and NTA, institute thanks researcher for flagging issueIIT Roorkee says issue was temporary and limitedIn a statement posted on X, IIT Roorkee said, “The information circulating on social media is misleading and does not accurately reflect what happened. There is an attempt at spreading misinformation, which is far from the truth.”According to the institute, the issue arose on June 2, 2026, when “certain technical interventions were undertaken on an expedited basis to assist candidates experiencing difficulties in accessing admit card data and to ensure the smooth functioning of the registration process.”IIT Roorkee said these interventions “resulted in a minimal, temporary misconfiguration in a cloud storage component.” The institute added that Rylen Anil identified the issue and reported it, following which “the issue was immediately rectified and access to the data was restricted.”The institute further stated that “the affected storage was read only, meaning no data could be edited or deleted.”No evidence of mass download, says instituteAddressing concerns over the scale of exposure, IIT Roorkee said an examination of cloud logs showed that “no bulk download occurred” and that “the read-only access was limited to less than 0.05% of the data.”It also asserted that “no sensitive information was compromised or mass-extracted” and that the incident had “zero impact on examination outcomes, including marks, ranks, and category of the candidates.”The institute said it remained committed to “maintaining the integrity, security, and transparency of the JEE (Advanced) and JoSAA counselling processes.”Researcher distances himself from leak claimsRylen Anil also issued a clarification after the controversy escalated.“I have noticed claims saying all JEE candidate data was leaked. While there was a vulnerability, I have not seen evidence supporting claims of a large-scale leak,” he wrote on X.In another post, he added: “I only downloaded a small number of files for verification purposes and deleted them afterwards.”Calling for restraint, the researcher said, “This is a serious matter and should not be used to make unfounded claims or spread misinformation.”The exchange marks a rare instance in which both an institution and a cybersecurity researcher publicly agreed that a vulnerability existed while disputing claims that it resulted in a large-scale data leak.Ready to navigate global policies? Secure your overseas future. Get expert guidance now!