Typical testbook rookie mistake
the sensitive data like this dataset of PII and payment attempts was loaded into the frontend JavaScript and available client-side, rather than being properly protected on the server with strict access controls.
Another live CBSE prod portal has been pwned - this time it's a huge amount of PII leak. CERT-In & CBSE were notified of the exploit.