Now Reading: Cyberattacks hit 20 financial institutions, CERT-In warns on API flaws
-
01
Cyberattacks hit 20 financial institutions, CERT-In warns on API flaws
Around 20 financial institutions were affected by cyberattacks earlier in October 2026, with hackers allegedly using stolen partner-bank credentials and exploiting vulnerabilities in payment APIs to siphon off funds, people familiar with the development told ET.
The Indian Computer Emergency Response Team (CERT-In) issued an advisory on 9 October flagging multiple attacks. It said attackers bypassed customer verification and payment authorisation controls, using AI-assisted tools and custom scripts to execute fraudulent transfers. CERT-In advised banks, NBFCs and fintech firms to suspend compromised interfaces, rotate credentials, introduce multi-factor authentication and enforce maker-checker approvals for fund transfers.
Affected entities have moved to disable vulnerable interfaces and block unauthorised access. The identity of the technology provider whose platform was allegedly exploited, and the extent of financial losses, could not be independently established.
Indian Opinion Analysis
The scale of the breach, 20 institutions compromised through stolen partner-bank credentials, points to a systemic vulnerability in how financial firms manage third-party API integrations. CERT-In’s advisory, while prescribing immediate fixes, leaves open whether the sector’s security architecture can withstand attacks that originate from within its own authorised infrastructure. The next step for affected entities is to ensure every payout is linked to a verified customer and an authorised transaction, a process that will require reviewing all third-party integrations.
Source: economictimes.indiatimes.com
This brief was synthesised by AI from the source linked above. Methodology and corrections.
