MobiKwik faces data leak claims
INDIA’S central bank has ordered digital payments firm MobiKwik to probe allegations that data of its 110 million users was breached, and warned that the company will face fines if lapses are found, a source with direct knowledge of the situation said last Thursday (1).
MobiKwik, which is backed by Sequoia Capital and India’s Bajaj Finance, has faced growing criticism for denying a leak many customers and digital rights activists say is linked to the company’s database.
The Reserve Bank of India (RBI) was “not happy” with the company’s initial response, said the source, who declined to be named as the discussion between the RBI and the company was private.
“The RBI has given MobiKwik an ultimatum and ordered them to retain an external auditor to conduct a forensic audit,” said the source, adding the RBI could also impose fines if the breach is proven.
The RBI did not respond to a request for comment. The central bank has the power to fine a payment systems provider a minimum of `500,000 (£4,924) in such cases.
The payments firm has also faced a backlash for threatening legal action against a security researcher who first flagged the breach.
Users said last week they had found information such as their credit card details on a leaked online database that allegedly belonged to MobiKwik, a claim the company has denied.
MobiKwik did not respond to a request for comment. It has previously said users could have uploaded their data on several platforms and it was incorrect to say the leaked information was accessed from the payments company, adding it takes privacy and security very seriously.
With 120 million users, MobiKwik competes in India with firms like Alibaba-backed Paytm and Google’s payments service, which have witnessed a rapid surge in usage. But data breaches and leaks have also become common in the country.
Last Wednesday (31), New Delhibased digital rights group the Internet Freedom Foundation (IFF) asked India’s cyber security agency to probe the alleged data breach. The federal agency did not respond to queries from reporters.