MUMBAI (Reuters) – Fears Indian telecom upstart Reliance Jio suffered a major data breach, compromising the personal data of over 100 million customers, have prompted calls for India to adopt more robust laws to protect consumers.
Jio has repeatedly denied any breach took place and said that names, telephone numbers and email addresses of Jio users on a website called “Magicapk” appeared to be “unauthentic”. The website was later shut down.
The company, part of conglomerate Reliance Industries Ltd., said last week that its subscriber data was safe and protected by the highest levels of security.
However, Jio filed a complaint the same day alleging unlawful access to its systems, police have told Reuters.
Jio did not respond to requests for comment.
In contrast to companies in the European Union, which has stringent data protection standards, companies in India do not have to disclose data breaches to clients, information security professionals said.
“It raises questions of security and accountability,” said Pranesh Prakash, policy director at the Centre for Internet and Society (CIS), a research organisation.
People complained on Twitter about personal information of Jio users being available on the Magicapk site. Several local news outlets said their checks had led them to believe a leak had occurred.
“A rule to report breaches exists, but it is unenforceable,” says Mr Prakash. “It says you’re not liable if you’re following reasonable security practices. What ‘reasonable’ means is not defined.”
Advocates of stronger laws in India say a data breach in countries with more stringent cyber laws, such as Britain or the United States, would prompt an inquiry by regulators.
After reports of a data leak at Verizon earlier this week, for example, the US telecoms firm quickly responded with an explanation of what had occurred, how it had happened and the extent of the problem.
“India is at a nascent stage. For good norms in Asia, look to Singapore. It’s been praised for not having cyber security issues by the UN,” Srinivas Kodali, an independent security researcher, said.
“We don’t have full-menu data protection laws,” said Apar Gupta, a Supreme Court lawyer working on data privacy issues. “We don’t even have an institutional framework or expert body to implement the limited data protection regulations that do exist. It’s so limited it’s more accurate to say no law exists.”
In May alone, there were two data security incidents in India.
The records of 17 million customers of Zomato, a popular food-delivery app, were put on sale online. Zomato initially advised customers that their passwords were secure, but later advised users to change them.
Separately, a CIS report said the Aadhaar numbers of as many as 135 million Indians had leaked from government databases and could be found online.
The number, similar to a US social security number, is unique to each Indian citizen and the Aadhaar database also stores a user’s biometric data. The government is pushing for Aadhaar numbers to be used in everything from opening bank accounts to filing tax returns.