Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures

Mumbai: As many as 20 financial institutions were affected earlier this month by a spate of cyberattacks in which funds were siphoned off using stolen partner-bank credentials, people familiar with the development told ET. In response, banks, non-banking financial companies (NBFCs) and fintech firms restricted payment and disbursement application programming interfaces (APIs), said the people cited earlier.

The attacks, which may have involved , prompted a critical advisory from the (CERT-In), warning financial institutions to suspend compromised interfaces and strengthen .

Also Read:

According to a person familiar with the incidents, a technology platform originally developed by a Chennai-based software company had vulnerabilities in its API controls that were allegedly exploited to siphon off funds. “The platform had deficiencies in its security architecture, particularly around payout APIs. These allowed transactions to be initiated without the checks that should ordinarily precede a disbursement, including customer verification,” the person said.

The person said the platform’s inadequate security controls and weak know-your-customer (KYC) checks raised concerns over the adequacy of merchant verification and transaction monitoring.

Also Read:

The identity of the technology provider and the extent of financial losses could not be independently established.

In its October 9 advisory, CERT-In flagged multiple attacks in which hackers bypassed customer verification, loan sanction and payment authorisation controls to execute fraudulent transfers. The agency also identified indications of AI-assisted offensive tools being used alongside custom scripts, potentially allowing attackers to identify vulnerabilities and execute more rapidly.

Following the CERT-In warning, affected entities have moved to disable vulnerable interfaces, block unauthorised access and strengthen transaction controls, the person said.

“The immediate priority is to ensure that every payout is linked to a verified customer and an authorised transaction. Banks and fintechs will have to review their third-party integrations and ensure that security checks cannot be bypassed even when valid API credentials are used,” the person said.

In its advisory, CERT-In said attackers were compromising internet-facing applications and stealing payment aggregator, gateway and partner-bank API credentials. These credentials were subsequently used to initiate transfers directly from financial institutions’ own authorised infrastructure, bypassing application-level safeguards.

The fraudulent transactions involved fictitious loan references, payments exceeding prescribed limits and transfers to mule accounts across multiple banks. Funds were rapidly transferred through IMPS and NEFT channels and withdrawn, complicating recovery.

The agency also warned that attackers could exploit outdated APIs, unsecured application interfaces and credentials embedded in source code. Such vulnerabilities could allow attackers to circumvent conventional security checks even when institutions have controls at the application level.

CERT-In has advised financial institutions to suspend compromised APIs, rotate credentials, introduce multi-factor authentication and enforce maker-checker approvals for fund transfers.

It has also recommended real-time transaction monitoring, limits on fund transfers, beneficiary verification and reconciliation of payouts against approved loan or payment records.