An Indian mobile payment giant MobiKwik has made it to the news in the wake of a cybersecurity incident. As reports suggest, MobiKwik has suffered a data breach that resulted in the customers’ data reaching the dark web. However, MobiKwik denies any security breach.
MobiKwik Data Breach Left Customer Data To Dark Web
Reportedly, an independent security researcher spotted a huge treasure trove of data belonging to Indian citizens on the dark web.
As the researcher Rajshekhar Rajaharia observed, a hacker put up ‘11 crore’ Indian cardholders’ data for sale on the dark web.
11 Crore Indian CardHolders data alleged leaked from @MobiKwik Server, Hacker claimed. It Seems hacker still have their data. Backup was alleged taken on 20Jan 2021. He claim to have mobikwik access since last 30 days. @RBI @IndianCERT Please look into this matter.#InfoSec #GDPR pic.twitter.com/tBS3U6Oqhw
— Rajshekhar Rajaharia (@rajaharia) March 4, 2021
Then, the hacker also shared another data sample clearly hinting that the data belonged to MobiKwik servers.
Eventually, it turned out that the hacker had put up around 8.2TB of data on the dark web for 1.5 BTC. This huge database included explicit details of millions of customers, which also included 3.5 million users’ KYC documents.
Whereas, the other breached details included the customers’ names, email addresses, passwords (hashed), addresses, GPS locations, lists of installed apps, partial credit card numbers, and bank details (such as the account numbers of linked banked accounts).
This extent of information also revealed another violation by MobiKwik regarding storing the customers’ card details without consent.
The MobiKwik leak is real. Here is what the dump had for me. One of those credit cards was valid until a couple weeks ago, and I don't recall authorising MobiKwik to save it. Companies that lie like ? ought to be taken to the cleaners. https://t.co/sptyC1Jz8f pic.twitter.com/c4Uu25OviP
— Kiran Jonnalagadda (@jackerhack) March 29, 2021
MobiKwik Denies Any Security Incident
While all the evidence and independent verifications clearly show a security breach at MobiKwik, the firm denies all such claims. Their initial rebuttal on Twitter states that the firm suffered no breach, nor does the breached data hint at any link with MobiKwik.
A media-crazed so-called security researcher has repeatedly over the last week presented concocted files wasting precious time of our organization while desperately trying to grab media attention.We thoroughly investigated his allegations and did not find any security lapses. 1/n
— MobiKwik (@MobiKwik) March 4, 2021
This response infuriated everyone, including the other researchers as well as the customers. Troy Hunt clearly condemned the way MobiKwik downplayed the data breach.
Never *ever* behave like @MobiKwik has in this thread from 25 days ago. Try Googling “mobikwik data breach” now… https://t.co/L5E4xc1ey0
— Troy Hunt (@troyhunt) March 29, 2021
Following the chaos, MobiKwik has recently released an official statement on the website. Here is what they state about the breached information for sale on the dark web.
Some users have reported that their data is visible on the darkweb. While we are investigating this, it is entirely possible that any user could have uploaded her/ his information on multiple platforms. Hence, it is incorrect to suggest that the data available on the darkweb has been accessed from MobiKwik or any identified source.
Whereas, they also advise their customers not to visit the dark web due to underlying security risks. (The customers started doing to check for the breach of their personal data.)
We strongly recommend that you do not try to open any darkweb/anonymous links as they could jeopardize your own cyber safety.
While the company boasts to have a bug bounty program as well, Rajaharia’s experience wasn’t good in this regard either.
My 1st March conversation With #Mobikwik after this serious data breach. I also reported a bug. They denied it too and removed that Bug in the next 1 hour. They saved their 1000 rupee bounty by denying it.#InfoSec #DataLeak #GDPR @sanjg2k1 @fs0c131y @troyhunt pic.twitter.com/pP0VRU0vqC
— Rajshekhar Rajaharia (@rajaharia) March 30, 2021
At the time of writing this article, details regarding how the attackers managed to exfiltrate the data remained unclear.
