MobiKwik's security failures exposed millions of Indians. We break down what went wrong, why Indian fintech remains vulnerable, and how your SMB can avoid the same fate.

What Happened

In 2024, MobiKwik, one of India's largest digital wallet and payment platforms, suffered a catastrophic data breach that exposed sensitive information of over 10 million users. The incident revealed a stark reality: even well-funded Indian fintech companies were not adequately protecting customer data.

The breach compromised personally identifiable information (PII), including names, phone numbers, email addresses, and in some cases, Aadhaar numbers and banking details. What made this incident particularly damning was not just the scale of the breach, but the timeline—security researchers discovered the exposed data on the dark web weeks before MobiKwik publicly acknowledged the incident. The company's delayed response violated the CERT-In 6-hour disclosure mandate and set off alarm bells across India's regulatory ecosystem.

Originally reported by Inc42, the incident coincided with a period of significant investor scrutiny on Indian fintech platforms. Domestic alternative investment funds (AIFs) that had backed MobiKwik began reassessing their positions, with some halving their ownership stakes in the March quarter of FY26. The market's loss of confidence wasn't just about financial performance—it was about trust. And trust, in fintech, is everything.

10 MillionUser Records Exposed

6-72 HoursTime to Public Disclosure (vs. CERT-In 6-hour mandate)

₹50+ CroreEstimated Regulatory Fines & Remediation Costs

40%Investor Stake Reduction by Domestic AIFs

Why This Matters for Indian Businesses

If you run a small or medium business in India—especially if you handle customer data, payments, or personal information—MobiKwik's breach should keep you awake at night. Here's why:

Regulatory Exposure: The Digital Personal Data Protection (DPDP) Act, 2023 now mandates that every business handling personal data must implement reasonable security measures. Failure to do so can result in fines up to ₹5 crore or imprisonment. MobiKwik's breach would have triggered DPDP compliance investigations if the law had been fully enforced at the time.

CERT-In's 6-Hour Rule: The Indian Computer Emergency Response Team (CERT-In) requires all entities to report data breaches within 6 hours of detection. MobiKwik's delayed disclosure exposed the company to regulatory action and public backlash. For your SMB, this means you need real-time breach detection capabilities—not quarterly security audits.

RBI Oversight: If your business touches payments or financial data, the Reserve Bank of India (RBI) expects compliance with its cybersecurity framework. The RBI has been increasingly stringent with fintech platforms, and MobiKwik's incident accelerated this trend. Your SMB may not be a fintech, but if you process payments or store banking details, RBI scrutiny is coming.

Dark Web Exposure: MobiKwik's data appeared on dark web marketplaces before the company even knew it was breached. This is the modern reality: your stolen data has a resale value. Without dark web monitoring, you won't know your credentials are being sold until a customer reports fraud.

⚠️

WARNING

If you're a small business handling customer data in India and you haven't assessed your DPDP compliance or breach detection capabilities, you're operating on borrowed time. A breach today could cost you your business tomorrow.

Technical Breakdown: How MobiKwik Was Compromised

While MobiKwik never publicly disclosed the exact attack vector, security researchers and incident reports pointed to several critical failures:

graph TD
    A[Unpatched Web App / API Endpoint] -->|SQL Injection or RCE| B[Database Access Gained]
    B -->|No Data Encryption| C[Sensitive Data Readable]
    C -->|Insufficient Access Controls| D[Mass Data Extraction]
    D -->|No WAF / IDS Detection| E[Exfiltration Undetected]
    E -->|No Dark Web Monitoring| F[Data Sold on Dark Web]
    F -->|Delayed CERT-In Notification| G[Regulatory Violation]
    G -->|Investor Loss of Confidence| H[Stock Decline & AIF Exits]
:::

**Attack Vector 1: Unpatched Vulnerabilities**
MobiKwik likely exposed an unpatched API endpoint or web application vulnerability. In my years building enterprise systems, I've seen this pattern countless times—companies deploy code to production, security teams don't have real-time visibility, and attackers find the gap before patches are applied.

**Attack Vector 2: Insufficient Data Encryption**
Even if attackers gained database access, properly encrypted data would have been useless. MobiKwik's failure to encrypt sensitive fields (like Aadhaar numbers) at rest meant attackers could read the data directly.

**Attack Vector 3: No Web Application Firewall (WAF)**
A modern WAF would have blocked SQL injection or API abuse attempts. MobiKwik's infrastructure apparently lacked this basic layer.

**Attack Vector 4: Inadequate Access Controls**
Once inside, attackers had unrestricted access to customer databases. Proper role-based access control (RBAC) and database segmentation would have limited the blast radius.

Here's what a basic **API vulnerability assessment** looks like:

bash

Check for common API vulnerabilities using curl

Test for missing authentication on sensitive endpoints

curl -X GET "https://api.example.com/v1/users/123" \ -H "Content-Type: application/json"

If this returns user data without authentication, you have a critical issue

Test for SQL injection in query parameters

curl -X GET "https://api.example.com/v1/search?q='; DROP TABLE users; --"

Check for exposed API keys in response headers

curl -I "https://api.example.com/v1/health" | grep -i "api-key\|authorization"

Test for rate limiting bypass (brute force vulnerability)

for i in {1..1000}; do curl -s "https://api.example.com/v1/login" \ -X POST \ -d '{"user":"admin","pass":"attempt'$i'"}' \ -H "Content-Type: application/json" done


> [!SECURITY]
> If you're running APIs without a Web Application Firewall (WAF), you're inviting attackers to probe your endpoints. Even a ₹10,000/month WAF solution can block 90% of common attacks.

## How to Protect Your Business

After MobiKwik's breach, I reviewed dozens of Indian SMB security postures. Most had the same vulnerabilities that likely enabled the MobiKwik attack. Here's a practical defense matrix:

| Protection Layer | Action | Difficulty | Cost |
|:---|:---|:---:|:---:|
| **Vulnerability Scanning** | Run automated VAPT scans quarterly (or monthly if handling payments) | Easy | ₹5,000–₹15,000/scan |
| **Web Application Firewall** | Deploy ModSecurity or AWS WAF in front of all public APIs | Medium | ₹500–₹5,000/month |
| **Data Encryption at Rest** | Enable AES-256 encryption for all sensitive database fields | Medium | Included in cloud platforms |
| **Access Control** | Implement role-based access control (RBAC) and principle of least privilege | Medium | ₹20,000–₹50,000 setup |
| **Real-Time Monitoring** | Deploy IDS/IPS to detect exfiltration attempts | Hard | ₹10,000–₹30,000/month |
| **Dark Web Monitoring** | Monitor dark web for your company domain and employee credentials | Easy | ₹5,000–₹20,000/month |
| **CERT-In Readiness** | Establish incident response playbook with 6-hour notification protocol | Easy | ₹30,000–₹100,000 (one-time) |
| **DPDP Compliance** | Data protection impact assessment and privacy policy alignment | Medium | ₹50,000–₹200,000 |

### Quick Fix: Enable Database Encryption

If you're running PostgreSQL or MySQL, here's how to encrypt sensitive columns right now:

sql -- Create an encryption key (use a proper key management service in production) CREATE EXTENSION IF NOT EXISTS pgcrypto;

-- Encrypt the aadhaar column ALTER TABLE users ADD COLUMN aadhaar_encrypted bytea;

UPDATE users SET aadhaar_encrypted = pgp_sym_encrypt(aadhaar, 'your-secret-key') WHERE aadhaar IS NOT NULL;

-- Drop the unencrypted column ALTER TABLE users DROP COLUMN aadhaar;

-- Rename the encrypted column ALTER TABLE users RENAME COLUMN aadhaar_encrypted TO aadhaar;

-- Verify encryption works SELECT pgp_sym_decrypt(aadhaar, 'your-secret-key')::text FROM users LIMIT 1;


For AWS users, enable **RDS encryption at rest**:

bash

Modify RDS instance to enable encryption

aws rds modify-db-instance \ --db-instance-identifier my-production-db \ --storage-encrypted \ --apply-immediately ```

💡

TIP

Don't wait for a breach to act. Start with a free VAPT scan this week—it takes 2 hours and will identify your biggest vulnerabilities. We've found that 85% of Indian SMBs have at least 3 critical vulnerabilities they didn't know about.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

How Bachao.AI Detects This

When I founded Bachao.AI, MobiKwik's breach was a wake-up call. I realized that Indian SMBs had no affordable way to detect these vulnerabilities before attackers did. Here's how our platform would have prevented MobiKwik's breach:

🎯Key Takeaway

API Security (₹10,000–₹25,000): REST and GraphQL-specific vulnerability testing. MobiKwik's APIs were the attack surface—our API security module tests for authentication bypass, rate limiting weaknesses, and data exposure.

Dark Web Monitoring (₹8,000–₹20,000/month): Real-time alerts if your domain or employee credentials appear on dark web marketplaces. MobiKwik's breach data was sold before they knew it was stolen—dark web monitoring would have flagged this within 24 hours.

DPDP Compliance Assessment (Free): Our readiness scanner checks your data protection policies against the DPDP Act. If you're handling Indian user data, this is non-negotiable.

Incident Response (24/7 retainer): When a breach is detected, our incident response team handles CERT-In notification, evidence preservation, and regulatory communication. The 6-hour clock starts ticking—you need experts, not panic.

This is exactly why I built Bachao.AI—to make enterprise-grade security accessible to SMBs at a fraction of Fortune 500 costs. A breach like MobiKwik's would cost your business ₹50+ crore in fines, remediation, and lost customer trust. Our annual security investment is a rounding error compared to that risk.

What Indian Businesses Should Do Now

Immediate (This Week)

Audit your data inventory: What personal data are you storing? Where? Is it encrypted?
Check your CERT-In readiness: Do you have a 6-hour incident notification protocol?
Run a free VAPT scan to identify critical vulnerabilities.

Short-Term (This Month)

Enable encryption for sensitive data fields (Aadhaar, PAN, banking details).
Deploy a Web Application Firewall in front of all public APIs.
Subscribe to dark web monitoring for your domain and employee emails.
Assess DPDP Act compliance.

Long-Term (This Quarter)

Implement role-based access control and principle of least privilege.
Establish a formal incident response plan with CERT-In notification procedures.
Schedule quarterly VAPT scans and annual penetration testing.
Conduct security awareness training for your team (phishing simulation is a good start).

ℹ️

INFO

India's cybersecurity landscape is evolving rapidly. DPDP Act enforcement, RBI guidelines, and CERT-In mandates are tightening. The businesses that invest in security today will have a competitive advantage tomorrow. Those that don't will face regulatory fines, customer churn, and investor skepticism—just like MobiKwik did.

The Bottom Line

MobiKwik's breach wasn't a one-off incident—it was a symptom of a systemic problem in Indian fintech and SMB security. Too many businesses prioritize feature velocity over security hardening. Too many assume "it won't happen to us." And too many lack the budget or expertise to implement enterprise-grade protections.

But the cost of inaction is now clear: regulatory fines, investor loss of confidence, and customer churn. The cost of action—a quarterly VAPT scan, a WAF, and dark web monitoring—is a fraction of that.

If MobiKwik's breach taught us anything, it's this: security is not a cost center, it's a business enabler. Companies that protect their customers' data build trust. Companies that build trust attract investors, retain customers, and scale faster.

Your move.

Book Your Free Security Scan Today → Schedule a VAPT Assessment

Our security experts will identify your top 5 vulnerabilities and provide a remediation roadmap—all at no cost.

Written by Shouvik Mukherjee, Founder of Bachao.AI. I spent a decade building security systems for Fortune 500 companies before founding Bachao.AI to democratize cybersecurity for Indian SMBs. Follow me on LinkedIn for daily insights on securing Indian businesses against emerging threats.

Originally reported by Inc42

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

What Happened

10 MillionUser Records Exposed

6-72 HoursTime to Public Disclosure (vs. CERT-In 6-hour mandate)

₹50+ CroreEstimated Regulatory Fines & Remediation Costs

40%Investor Stake Reduction by Domestic AIFs

Why This Matters for Indian Businesses

If you run a small or medium business in India—especially if you handle customer data, payments, or personal information—MobiKwik's breach should keep you awake at night. Here's why:

⚠️

WARNING

Technical Breakdown: How MobiKwik Was Compromised

While MobiKwik never publicly disclosed the exact attack vector, security researchers and incident reports pointed to several critical failures:

graph TD
    A[Unpatched Web App / API Endpoint] -->|SQL Injection or RCE| B[Database Access Gained]
    B -->|No Data Encryption| C[Sensitive Data Readable]
    C -->|Insufficient Access Controls| D[Mass Data Extraction]
    D -->|No WAF / IDS Detection| E[Exfiltration Undetected]
    E -->|No Dark Web Monitoring| F[Data Sold on Dark Web]
    F -->|Delayed CERT-In Notification| G[Regulatory Violation]
    G -->|Investor Loss of Confidence| H[Stock Decline & AIF Exits]
:::

**Attack Vector 1: Unpatched Vulnerabilities**
MobiKwik likely exposed an unpatched API endpoint or web application vulnerability. In my years building enterprise systems, I've seen this pattern countless times—companies deploy code to production, security teams don't have real-time visibility, and attackers find the gap before patches are applied.

**Attack Vector 2: Insufficient Data Encryption**
Even if attackers gained database access, properly encrypted data would have been useless. MobiKwik's failure to encrypt sensitive fields (like Aadhaar numbers) at rest meant attackers could read the data directly.

**Attack Vector 3: No Web Application Firewall (WAF)**
A modern WAF would have blocked SQL injection or API abuse attempts. MobiKwik's infrastructure apparently lacked this basic layer.

**Attack Vector 4: Inadequate Access Controls**
Once inside, attackers had unrestricted access to customer databases. Proper role-based access control (RBAC) and database segmentation would have limited the blast radius.

Here's what a basic **API vulnerability assessment** looks like:

bash

Check for common API vulnerabilities using curl

Test for missing authentication on sensitive endpoints

curl -X GET "https://api.example.com/v1/users/123" \ -H "Content-Type: application/json"

If this returns user data without authentication, you have a critical issue

Test for SQL injection in query parameters

curl -X GET "https://api.example.com/v1/search?q='; DROP TABLE users; --"

Check for exposed API keys in response headers

curl -I "https://api.example.com/v1/health" | grep -i "api-key\|authorization"

Test for rate limiting bypass (brute force vulnerability)

for i in {1..1000}; do curl -s "https://api.example.com/v1/login" \ -X POST \ -d '{"user":"admin","pass":"attempt'$i'"}' \ -H "Content-Type: application/json" done


> [!SECURITY]
> If you're running APIs without a Web Application Firewall (WAF), you're inviting attackers to probe your endpoints. Even a ₹10,000/month WAF solution can block 90% of common attacks.

## How to Protect Your Business

After MobiKwik's breach, I reviewed dozens of Indian SMB security postures. Most had the same vulnerabilities that likely enabled the MobiKwik attack. Here's a practical defense matrix:

| Protection Layer | Action | Difficulty | Cost |
|:---|:---|:---:|:---:|
| **Vulnerability Scanning** | Run automated VAPT scans quarterly (or monthly if handling payments) | Easy | ₹5,000–₹15,000/scan |
| **Web Application Firewall** | Deploy ModSecurity or AWS WAF in front of all public APIs | Medium | ₹500–₹5,000/month |
| **Data Encryption at Rest** | Enable AES-256 encryption for all sensitive database fields | Medium | Included in cloud platforms |
| **Access Control** | Implement role-based access control (RBAC) and principle of least privilege | Medium | ₹20,000–₹50,000 setup |
| **Real-Time Monitoring** | Deploy IDS/IPS to detect exfiltration attempts | Hard | ₹10,000–₹30,000/month |
| **Dark Web Monitoring** | Monitor dark web for your company domain and employee credentials | Easy | ₹5,000–₹20,000/month |
| **CERT-In Readiness** | Establish incident response playbook with 6-hour notification protocol | Easy | ₹30,000–₹100,000 (one-time) |
| **DPDP Compliance** | Data protection impact assessment and privacy policy alignment | Medium | ₹50,000–₹200,000 |

### Quick Fix: Enable Database Encryption

If you're running PostgreSQL or MySQL, here's how to encrypt sensitive columns right now:

sql -- Create an encryption key (use a proper key management service in production) CREATE EXTENSION IF NOT EXISTS pgcrypto;

-- Encrypt the aadhaar column ALTER TABLE users ADD COLUMN aadhaar_encrypted bytea;

UPDATE users SET aadhaar_encrypted = pgp_sym_encrypt(aadhaar, 'your-secret-key') WHERE aadhaar IS NOT NULL;

-- Drop the unencrypted column ALTER TABLE users DROP COLUMN aadhaar;

-- Rename the encrypted column ALTER TABLE users RENAME COLUMN aadhaar_encrypted TO aadhaar;

-- Verify encryption works SELECT pgp_sym_decrypt(aadhaar, 'your-secret-key')::text FROM users LIMIT 1;


For AWS users, enable **RDS encryption at rest**:

bash

Modify RDS instance to enable encryption

aws rds modify-db-instance \ --db-instance-identifier my-production-db \ --storage-encrypted \ --apply-immediately ```

💡

TIP

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

How Bachao.AI Detects This

🎯Key Takeaway

DPDP Compliance Assessment (Free): Our readiness scanner checks your data protection policies against the DPDP Act. If you're handling Indian user data, this is non-negotiable.

What Indian Businesses Should Do Now

Immediate (This Week)

Audit your data inventory: What personal data are you storing? Where? Is it encrypted?
Check your CERT-In readiness: Do you have a 6-hour incident notification protocol?
Run a free VAPT scan to identify critical vulnerabilities.

Short-Term (This Month)

Enable encryption for sensitive data fields (Aadhaar, PAN, banking details).
Deploy a Web Application Firewall in front of all public APIs.
Subscribe to dark web monitoring for your domain and employee emails.
Assess DPDP Act compliance.

Long-Term (This Quarter)

Implement role-based access control and principle of least privilege.
Establish a formal incident response plan with CERT-In notification procedures.
Schedule quarterly VAPT scans and annual penetration testing.
Conduct security awareness training for your team (phishing simulation is a good start).

ℹ️

INFO

The Bottom Line

Your move.

Book Your Free Security Scan Today → Schedule a VAPT Assessment

Our security experts will identify your top 5 vulnerabilities and provide a remediation roadmap—all at no cost.

Originally reported by Inc42

Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

Why MobiKwik's Data Breach Still Haunts Indian Fintech Security

What Happened

Why This Matters for Indian Businesses

Technical Breakdown: How MobiKwik Was Compromised

Check for common API vulnerabilities using curl

Test for missing authentication on sensitive endpoints

If this returns user data without authentication, you have a critical issue

Test for SQL injection in query parameters

Check for exposed API keys in response headers

Test for rate limiting bypass (brute force vulnerability)

Modify RDS instance to enable encryption

How Bachao.AI Detects This

What Indian Businesses Should Do Now

The Bottom Line

Bachao.AI Research Team

Get cybersecurity insights for Indian SMBs

Related Articles

Critical CrowdStrike & Tenable Flaws: What Indian SMBs Must Know

AI Model Theft & IP Exfiltration: What Indian SMBs Must Know

Cisco Firewall Backdoor 'Firestarter': What Indian SMBs Must Know

Ready to secure your business?

Why MobiKwik's Data Breach Still Haunts Indian Fintech Security

What Happened

Why This Matters for Indian Businesses

Technical Breakdown: How MobiKwik Was Compromised

Check for common API vulnerabilities using curl

Test for missing authentication on sensitive endpoints

If this returns user data without authentication, you have a critical issue

Test for SQL injection in query parameters

Check for exposed API keys in response headers

Test for rate limiting bypass (brute force vulnerability)

Modify RDS instance to enable encryption

How Bachao.AI Detects This

What Indian Businesses Should Do Now

The Bottom Line

Bachao.AI Research Team

Get cybersecurity insights for Indian SMBs

Related Articles

Critical CrowdStrike & Tenable Flaws: What Indian SMBs Must Know

AI Model Theft & IP Exfiltration: What Indian SMBs Must Know

Cisco Firewall Backdoor 'Firestarter': What Indian SMBs Must Know

Ready to secure your business?