Thread by @internetfreedom

#MobikwikDataLeak
We have written to @IndianCERT asking them to initiate an inquiry over the Mobikwik data breach under Sec. 70B(6) of the IT Act. We lay out 5 steps MobiKwik must take to alleviate the situation. Pls read and RT for public knowledge.
1/n
internetfreedom.in/mobikwik-data-…

Over 8.2 TB of data of MobiKwik users has reportedly been put on sale over the dark web with an asking price of 1.5 Bitcoin (~ INR 65 Lakhs). The leak includes KYC, passport, address, email, phone number and aadhar card details of 10 Crore Indians.
indianexpress.com/article/techno…
2/n

MobiKwik's denial has been countered by independent researchers who indicate that a breach has occurred. MobiKwik also reportedly sought help from Amazon last month after they discovered that someone outside the organisation downloaded their S3 data.

https://twitter.com/jackerhack/status/1376601029035192321

3/n

What should MobiKwik do instead of deflecting blame?

1. It must individually inform each affected user of the extent to which the breach has impacted them.

2. It must then move towards providing remedies, including examining if any restitution is necessary.
4/n

3. MobiKwik should provide an explanation on why such a breach took place, provide details including the number of affected users and the date and time of the breach, and issue a statement explaining steps taken to ensure that such a breach does not occur in the future.
5/n

4. An independent agency must conduct a third party forensic data security audit. We commend MobiKwik for making a public commitment to conduct it but it must be done independently through a firm of repute and its findings must be made public.
6/n

5. MobiKwik threatened legal action against the cyber security researcher who uncovered the breach. It must immediately be recalled. Policy reform is needed as cyber security researchers face threats of legal prosecution without legislative protection.
7/n
internetfreedom.in/security-resea…

Given the data breach, violation of the right to privacy and the lack of a response by MobiKwik, we are hopeful that our representation to @IndianCERT will compel MobiKwik to act responsibly and provide accountability to its users.
8/n

Such breaches are rising. The Personal Data Protection Bill, 2019 contains several clauses relating to security but they are insufficient. Given that it is being reviewed by a Joint Parliamentary Committee currently, a conversation around it is the need of the hour.
9/10

We have started a public information series where we talk about the need for a data law, the bill’s provisions and loopholes, where accountability from authorities is needed, and what you can do to advocate for your rights. Follow it here. #SaveOurPrivacy

https://twitter.com/internetfreedom/status/1375302434315116544