Around 20 Indian financial institutions—including commercial banks, non-banking financial companies (NBFCs), payment aggregators, and fintech firms—were hit by sophisticated cyberattacks that exploited compromised credentials and payment application programming interface (API) vulnerabilities.
Following the breaches, India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), issued a critical advisory (CIAD-2026-0046) instructing financial entities to overhaul their digital payment architecture and API security controls.
1. How the Cyberattack Unfolded
Attackers targeted the underlying API infrastructure connecting digital lending apps, payment processors, and partner banks:
-
Exploitation of Stolen Credentials: Hackers acquired valid partner-bank and service-provider credentials to gain unauthorized access to trusted payment interfaces.
-
Bypassing Approval Controls: Using compromised APIs, attackers injected fraudulent loan-disbursal and payment instructions while bypassing standard controls such as Know Your Customer (KYC) verification, loan approval records, and transaction limit checks.
-
Rapid Disbursal to Mule Accounts: Funds were routed swiftly through legitimate, whitelisted infrastructure directly into suspected money-mule accounts before automatic fraud detection systems could flag the unauthorized activity.
2. Key Vulnerabilities Highlighted by CERT-In
The advisory identified critical system weaknesses across affected financial entities:
-
Exposed & Outdated APIs: Use of legacy, deprecated, or inadequately authenticated APIs that remained connected to live banking backends.
-
Third-Party Integration Risks: Weak isolation and security monitoring at the intersection between lending platforms and banking partners.
-
Absence of Real-Time Validation: Failure of payment processing backends to verify whether a payment request matched a genuine, approved loan reference number before executing payout instructions.
3. Mandatory Security Measures Recommended for Financial Firms
CERT-In advised financial institutions, NBFCs, and digital payment providers to immediately implement the following security safeguards:
-
Strict API Authentication & Rate-Limiting: Enforce multi-factor authentication (MFA), Mutual TLS (mTLS), and strict API token expiration to secure server-to-server communication.
-
Dual-Stage Authorization: Ensure automated loan-disbursal systems mandate independent verification of valid loan approval records before releasing funds via banking APIs.
-
Continuous Monitoring & Anomaly Detection: Deploy AI-driven fraud monitoring tools to detect sudden spikes in transaction frequency or rapid payouts to newly created accounts.
-
Deprecate Legacy Endpoints: Conduct comprehensive audits to identify and decommission unused, unmonitored, or outdated API endpoints.
