MobiKwik, 2021: the breach that was denied while people searched their own KYC files

In March 2021, a portal appeared on a dark web site that let anyone type in a phone number and see what it returned. Indian journalists typed in their own. Several reported getting back their own addresses, their own card details in part, and images of their own Aadhaar and PAN cards. MobiKwik, the payments company the data was attributed to, said no breach had occurred. It has never said otherwise.

What is documented, and what is not

This case file is written differently from the others on this site, because the usual materials do not exist. There is no regulatory penalty notice, no court judgment, no company disclosure setting out a timeline. What follows separates what the public record establishes from what was claimed.

Established: a dataset advertised as containing MobiKwik user data was offered for sale in early 2021. A searchable interface was made available by the seller in late March, and multiple identifiable people, including working journalists who wrote about it under their own names, reported retrieving accurate personal records about themselves from it, including identity document images. MobiKwik publicly and repeatedly denied that its systems had been breached. The Reserve Bank of India directed the company to commission a third-party forensic audit. The sale portal was withdrawn by the seller at the end of March 2021.

Claimed but not independently established: the figures of 8.2 terabytes and 99 million users, which came from the seller and from researchers examining the advertisement rather than from any verified count. The method of compromise, which was never described by anyone in a position to know. Any attribution of the seller.

Never published: the findings of the forensic audit.

The researcher problem

The alarm was raised by an independent security researcher, Rajshekhar Rajaharia, who had been publicising the dataset since January. The company's response characterised him in dismissive terms rather than engaging with the technical claim.

This is a pattern with real consequences. Independent researchers are, in practice, a substantial part of how breaches involving Indian companies come to light, because there is no obligation on a company to find or report one. If the reliable outcome of reporting a finding is public hostility and legal exposure, researchers stop reporting, or report anonymously to journalists instead of privately to the company, which is worse for everybody including the company.

The countries that have handled this better did so by establishing safe harbour: a documented vulnerability disclosure policy, a contact address that reaches security rather than legal, and a commitment not to pursue good-faith researchers. It costs very little and it changes which way information flows.

The timeline

1. January 2021: A researcher publicly flags a dataset advertised as MobiKwik user data.
2. February 2021: MobiKwik states that an investigation found no evidence of a breach and describes the reports as false.
3. Late March 2021: A searchable portal appears; users and journalists report finding their own records, including KYC document images.
4. End of March 2021: The Reserve Bank of India directs MobiKwik to commission a third-party forensic audit; the company says it will do so.
5. 31 March 2021: The seller withdraws the portal.
6. Afterwards: No audit findings are published, no regulatory penalty is announced, and no confirmation or retraction follows.

What it changed

It became a reference point in the argument for India's data protection law. The Digital Personal Data Protection Act 2023 introduced breach notification duties and a regulator with penalty powers. The gap this case exposed, a large alleged exposure of identity documents with no obligation to confirm, notify or explain, is exactly the gap that legislation was written to close.

It sharpened scrutiny of KYC data retention in Indian fintech. The underlying question the case raised is why full identity document images were retained in a form that could be exfiltrated in bulk at all, years after onboarding. Tokenised verification and reference-only storage have gained ground since.

It demonstrated the limits of denial in the era of searchable dumps. A company can dispute a researcher's analysis. It cannot easily dispute a journalist who has retrieved their own Aadhaar card from a portal and written about it. The availability of self-service verification changed the dynamics of breach denial permanently.

It remains unresolved, and this page will say so until that changes. Marking a case as disputed rather than picking the more satisfying version of it is the only honest option when the evidence stops where this evidence stops.

What to do if you were a user