Around 20 financial institutions in India — spanning banks, non-banking financial companies (NBFCs) and fintech firms — were hit by a wave of cyberattacks earlier this month, in what is trending per news coverage as one of the most significant reported threats to the country's digital financial infrastructure this year. According to an investigation published by The Economic Times on 15 October 2026, attackers allegedly used stolen partner-bank credentials and weaknesses in payment and loan-disbursement APIs to siphon off funds, bypassing many of the checks that are supposed to keep digital money movement safe.
India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), had already issued a "Critical" severity advisory on 9 October 2026 warning financial firms about coordinated attack campaigns targeting exactly this kind of infrastructure. The advisory, issued jointly with its finance-sector arm CSIRT-Fin, did not name affected entities or quantify losses — and the total amount of money involved has still not been publicly established. But the picture emerging from the reporting is of a systematic, technically sophisticated campaign rather than a single opportunistic hack.
What happened
According to people familiar with the matter cited by The Economic Times, the attacks unfolded earlier in October 2026. The attackers allegedly exploited vulnerabilities in a financial technology platform originally developed by a Chennai-based software company, which financial institutions used to process payments and disbursements. The platform's security controls were allegedly inadequate, giving attackers a way in.
Once inside, the attackers reportedly used stolen credentials belonging to a partner bank to invoke payment and disbursement functions directly. Because the transactions travelled through legitimate, whitelisted infrastructure, they looked — to many automated systems — like ordinary business. In response, banks, NBFCs and fintech firms restricted payment and disbursement application programming interfaces (APIs), the machine-to-machine channels that let financial software talk to other financial software.
The identity of the technology provider and the total financial losses could not be independently verified at the time of reporting, and neither CERT-In's advisory nor the press coverage has publicly named the affected institutions. That caution matters: in fast-moving cyber incidents, early figures often change as forensic investigations progress.
How the attacks allegedly worked
CERT-In's advisory describes a multi-stage technique that is worth understanding, because it explains why these attacks are so hard to stop with conventional defences:
- Initial compromise. Threat actors compromise internet-facing applications, exposed APIs or privileged endpoints — the outward-facing doors of a financial firm's systems.
- Credential theft. Attackers steal payment aggregator or gateway credentials and partner-bank API credentials, giving them the keys to initiate transactions.
- Direct API invocation. Instead of going through the normal app screens, attackers invoke disbursal and fund-transfer APIs directly from within the entities' own whitelisted infrastructure. To downstream systems, the calls appear to come from a trusted source.
- Control bypass. Because the API calls skip the application layer, they bypass controls such as loan creation, KYC (know-your-customer) verification, sanction screening, beneficiary verification, balance sufficiency checks and per-transaction limits.
- Rapid cash-out. The fraudulent transactions carry dummy reference identifiers, exceed per-transaction limits and credit funds to attacker-controlled mule accounts across multiple banks. Funds are then moved quickly through IMPS and NEFT rails and withdrawn immediately.
The reports also suggest the attacks may have involved AI-assisted hacking tools and custom scripts, although their precise role has not been established. The possible use of AI tooling in offensive cyber operations is a growing concern for defenders worldwide, as AI can speed up vulnerability discovery and the crafting of tailored exploits — a theme also visible in the broader AI boom, with chip demand surging as AI adoption accelerates (see ASML's record sales on AI chip demand).
What CERT-In's advisory said
CERT-In's 9 October advisory, rated "Critical", warned NBFCs, digital lending platforms, fintech firms, payment service providers and wallet operators about coordinated cyberattack campaigns resulting in unauthorised fund transfers. It said threat actors were observed "bypassing KYC requirements" by abusing trusted infrastructure — a striking finding, because KYC is one of the cornerstones of financial crime prevention.
The advisory urged institutions to suspend compromised interfaces, strengthen transaction safeguards and tighten customer verification. Its recommended priorities, echoed in industry coverage, include API security hardening, credential rotation, maker-checker controls on sensitive operations, beneficiary verification, stronger transaction monitoring and well-rehearsed incident response plans.
The timing is significant. The advisory came before the full scale of the campaign became public through press reporting, suggesting that CERT-In and CSIRT-Fin were tracking the pattern as it developed and moved to warn the sector while attacks were still unfolding.
Why payment APIs are such a tempting target
APIs are the plumbing of modern finance. They let a lending app disburse a loan, a wallet move money, or a payment gateway settle a transaction — all without human intervention. That automation is what makes India's digital finance ecosystem so fast and scalable, and it is also what makes API security so critical.
The alleged technique in this campaign exploited a deep weakness: trust. Financial systems are designed to trust calls that come from whitelisted infrastructure using valid credentials. When attackers obtain those credentials and operate from inside the trusted perimeter, many traditional defences — firewalls, login screens, even some fraud filters — see nothing unusual. The fraud only becomes visible when someone notices the pattern: dummy references, broken limits, money racing to mule accounts.
This is why security specialists increasingly argue that API security cannot rely on a perimeter alone. Each API call should be verified on its own merits — checking not just who is calling, but whether the transaction itself makes sense: Is the beneficiary verified? Does the amount respect limits? Does the reference match a real loan or payment? Defence in depth, rather than a single trusted gate, is the lesson of this incident.
What banks and fintech firms did next
According to the reporting, affected institutions moved quickly to restrict payment and disbursement APIs once the pattern was understood. Emergency restrictions on vulnerable payment interfaces are a standard first response: they stop the bleeding while forensic teams trace the intrusion, rotate credentials and rebuild compromised components.
The episode also lands at a moment when India's financial sector is in the spotlight for other reasons — from large banking deals to the country's deepening digital economy, including the impending Jio Platforms IPO, India's largest-ever issue, and the IDBI Bank sale to Fairfax. For investors and customers alike, the incident is a reminder that cybersecurity is now a core part of financial stability, not just an IT concern.
What it means for ordinary customers
There is no public evidence so far that individual customers' bank accounts were directly breached in this campaign; the reported attacks targeted institutional payment rails and disbursement systems. Still, incidents like this are a good prompt for basic digital hygiene:
- Watch your statements. Check bank and wallet statements regularly and report unfamiliar transactions immediately — speed matters, because stolen funds are withdrawn fast.
- Never share OTPs or PINs. No legitimate bank or fintech employee will ever ask for them, and fraudsters often exploit the confusion after a widely reported incident.
- Beware of follow-on phishing. After a big cyber story breaks, fake "security alert" messages and calls spike. Verify any alert by contacting your bank through its official app or number, not through links in a message.
- Use official apps and strong authentication. Keep banking apps updated, enable transaction alerts, and use biometrics or strong passwords where available.
What happens next
Forensic investigations will determine the full scale of the losses and whether the campaign has been fully contained. Regulators and industry bodies are likely to press for tighter API security standards, mandatory credential hygiene, and faster incident reporting across the sector. The episode may also accelerate adoption of zero-trust architectures in financial services — systems that verify every request, every time, rather than trusting anything inside the network.
For now, the key facts are these: around 20 institutions were affected, a critical government advisory warned the sector on 9 October, and press reporting on 15 October brought the campaign into public view. The total losses remain unconfirmed, and the investigation continues. Worldlession will update this story as verified details emerge.
Investigators are also dismantling fraud run from overseas, including the alleged $126 million counterfeit US postage operation shut down with an arrest in Pakistan.
India's banks are facing both attacks and leaks, including SBI's report that 3,897 customer records were found on the dark web.
Sources: The Economic Times investigation (15 October 2026), as reported by TelecomLive and 15 Minute News; CERT-In / CSIRT-Fin advisory (9 October 2026), as analysed by MediaNama; The420.in cybersecurity coverage.