An Indian mobile payment giant MobiKwik has made it to the news in the wake of a cybersecurity incident. As reports suggest, MobiKwik has suffered a data breach that resulted in the customers’ data reaching the dark web. However, MobiKwik denies any security breach.
MobiKwik Data Breach Left Customer Data To Dark Web
Reportedly, an independent security researcher spotted a huge treasure trove of data belonging to Indian citizens on the dark web.
As the researcher Rajshekhar Rajaharia observed, a hacker put up ‘11 crore’ Indian cardholders’ data for sale on the dark web.
Then, the hacker also shared another data sample clearly hinting that the data belonged to MobiKwik servers.
Eventually, it turned out that the hacker had put up around 8.2TB of data on the dark web for 1.5 BTC. This huge database included explicit details of millions of customers, which also included 3.5 million users’ KYC documents.
Whereas, the other breached details included the customers’ names, email addresses, passwords (hashed), addresses, GPS locations, lists of installed apps, partial credit card numbers, and bank details (such as the account numbers of linked banked accounts).
This extent of information also revealed another violation by MobiKwik regarding storing the customers’ card details without consent.
MobiKwik Denies Any Security Incident
While all the evidence and independent verifications clearly show a security breach at MobiKwik, the firm denies all such claims. Their initial rebuttal on Twitter states that the firm suffered no breach, nor does the breached data hint at any link with MobiKwik.
This response infuriated everyone, including the other researchers as well as the customers. Troy Hunt clearly condemned the way MobiKwik downplayed the data breach.
Following the chaos, MobiKwik has recently released an official statement on the website. Here is what they state about the breached information for sale on the dark web.
Some users have reported that their data is visible on the darkweb. While we are investigating this, it is entirely possible that any user could have uploaded her/ his information on multiple platforms. Hence, it is incorrect to suggest that the data available on the darkweb has been accessed from MobiKwik or any identified source.
Whereas, they also advise their customers not to visit the dark web due to underlying security risks. (The customers started doing to check for the breach of their personal data.)
We strongly recommend that you do not try to open any darkweb/anonymous links as they could jeopardize your own cyber safety.
While the company boasts to have a bug bounty program as well, Rajaharia’s experience wasn’t good in this regard either.
At the time of writing this article, details regarding how the attackers managed to exfiltrate the data remained unclear.