# Cyberattacks hit 20 financial institutions, CERT-In warns on API flaws 2026-10-14T20:27:02+00:00 | Governance | Indian Opinion Desk Corroboration: 1 independent outlet Around 20 financial institutions were affected by cyberattacks earlier in October 2026, with hackers allegedly using stolen partner-bank credentials and exploiting vulnerabilities in payment APIs to siphon off funds, people familiar with the development told ET. The Indian Computer Emergency Response Team (CERT-In) issued an advisory on 9 October flagging multiple attacks. It said attackers bypassed customer verification and payment authorisation controls, using AI-assisted tools and custom scripts to execute fraudulent transfers. CERT-In advised banks, NBFCs and fintech firms to suspend compromised interfaces, rotate credentials, introduce multi-factor authentication and enforce maker-checker approvals for fund transfers. Affected entities have moved to disable vulnerable interfaces and block unauthorised access. The identity of the technology provider whose platform was allegedly exploited, and the extent of financial losses, could not be independently established. ## Indian Opinion Analysis The scale of the breach, 20 institutions compromised through stolen partner-bank credentials, points to a systemic vulnerability in how financial firms manage third-party API integrations. CERT-In’s advisory, while prescribing immediate fixes, leaves open whether the sector’s security architecture can withstand attacks that originate from within its own authorised infrastructure. The next step for affected entities is to ensure every payout is linked to a verified customer and an authorised transaction, a process that will require reviewing all third-party integrations. ## Coverage - economictimes.indiatimes.com Straight news report with attribution to unnamed people familiar This brief was synthesised by AI from the source linked above. Tags: API vulnerabilities, CERT-In, cyberattacks, financial institutions, Mumbai Canonical: https://indianopinion.org/cyberattacks-hit-20-financial-institutions-cert-in-warns-on-api-flaws/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/cyberattacks-hit-20-financial-institutions-cert-in-warns-on-api-flaws/#story-in-brief How this brief was made: an AI model read the report linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/