MobiKwik met an alleged 110M-user data leak with denial and a legal threat

MobiKwik is one of India's largest mobile-payment wallets, holding the identity documents that Indian rules require customers to submit — KYC details, Aadhaar identity numbers, card and phone data. In early March 2021 a security researcher reported that a dataset said to belong to MobiKwik, covering roughly 110 million users, had appeared for sale on a dark-web forum.

MobiKwik's response was immediate denial. On 4 March it said it had found no security lapse, and its legal team said it would take strict action against the researcher. When users began checking and reported that some of the leaked data looked genuine, the story only grew. India's computer emergency team, CERT-In, shared a sample of the data with MobiKwik; the company said the sample was not its data.

The denial did not contain the crisis. With the allegation now public and contested, the Reserve Bank of India ordered MobiKwik to undergo a forensic audit of its systems by a CERT-In-certified auditor. A payments company that handles identity data had turned a security allegation into a regulatory examination.

The case is now cited for its crisis response rather than the breach itself, which MobiKwik continued to dispute. When a company holding sensitive data is told it has leaked, denying it and threatening the messenger invites users, researchers and the regulator to verify — and the regulator's audit, not the company's denial, becomes the story.