Best is to keep cards in an inactive state all the time for domestic and international.

Active ONLY when doing transactions.

It is leaked within icici customers (not outside).

Means: 17k cards were exposed to existing customers of icici bank.

Scary part was "leaked card was visible in iMobile app to random users and they were able to control cards settings too as like they control their cards, number cvv and expiry all were placed as it is their card, some users were able to see upto 10 different cards (amazon pay card of 10 different users) in their iMobile with complete control including limit and transaction settings modification.

So disabled or inactive settings weren't helpful in this case but yes it was not leaked to other than icici customers.

That's it.

I follow simple rule- just block your all cards temporarily and deactivate all transaction usages. Only unlock and activate your card when you are performing any transaction. This two step ensures that even if your card is unblocked by any means you'll have to activate your usage transaction individually each and every time.

Due to this, I forget sometimes, my transaction gets failed due to temporarily block and deactivated transaction channel usages. 

So today I read on Twitter that someone gave otp to someone claiming from ICICI Bank and their card got debited almost 1.5 lakhs

2nd

It's written ex155ap on the box not ex255ap