Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures
Around 20 financial institutions were affected by cyberattacks earlier this month, with hackers allegedly exploiting stolen partner-bank credentials and vulnerabilities in payment APIs to siphon off funds. Following the attacks, CERT-In issued an advisory urging banks, NBFCs and fintech firms to suspend compromised interfaces, strengthen transaction safeguards and tighten customer verification.
On October 9, the Indian Computer Emergency Response Team (CERT-In) released an advisory warning financial institutions about a series of cyberattacks affecting 20 institutions. The attacks involved stolen partner-bank credentials and resulted in funds being siphoned off. Concerns arose over vulnerabilities in payment and disbursement application programming interfaces (APIs) that may have been exploited by AI-assisted hacking tools.
CERT-In's advisory emphasized the need for financial institutions to suspend compromised interfaces and enhance transaction safeguards. The attacks reportedly bypassed customer verification, loan sanction, and payment authorization controls. Fraudulent transfers occurred using fictitious loan references, exceeding prescribed limits, and were sent to mule accounts across multiple banks. Funds were rapidly transferred via IMPS and NEFT channels, complicating the recovery process.
CERT-In advised institutions to stop using compromised APIs, rotate credentials, introduce multi-factor authentication, and enforce maker-checker approvals for fund transfers. Real-time transaction monitoring, transfer limits, beneficiary verification, and reconciliation of payouts against approved records were also recommended. The extent of financial losses and the identity of the technology provider involved in the attacks could not be independently verified.
Written by urgent.news from The Economic Times - Top News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
