Subscribers of Reliance Jio, a mobile carrier based in India, have their data leaked to the internet through a search engine via a website called Magicapk.com.
The data include personal information such as names, phone numbers, email addresses and SIM activation date. It also included information for users' Aadhaar numbers (a unique identification number [UIDAI, Unique Identification Authority of India] issued to more than 80 percent of Indian by the government so they can apply for things like subsidized products).
It was unclear about how many subscribers' information were leaked, but noting that Jio had 112 million subscribers in June, it was predicted that numbers are many.
While some confirms that some of the information was legitimate, Jio itself believes that the leaked material is "unauthentic", "unverified" and "unsubstantiated".
The information breach was said to come from a weak spot in Jio's management process. What's more, subscribers of Jio have less to no ability to protect themselves from such attack.
This is because India doesn't have a strong privacy laws to hold companies accountable for leaked or stolen data. India also doesn't require companies to use encryption to protect customers' details. And because Jio is based on Aadhaar's KYC system, subscribers cannot sue the company.
The Navi Mumbai and Maharashtra Cyber police teams zeroed in on the prime suspect in the western state of Rajasthan on Tuesday The police detained a man on suspicion of involvement in the breach after the cyber police team got a lead which was thoroughly analyzed to pinpoint information on the culprit.
The person had posted a message on an online message board on July 5, claiming to offer personal user details of anybody having a Jio SIM card and said it was available from the customer's original details.
Jio and other mobile network carriers in India have been put on alert in the wake of WannaCry and NotPetya ransomware that attacks companies across various sectors.
