20 Banks par Cyberattack: chori credentials aur kamzor payment API se paisa nikala — CERT-In ne jari ki warning

Desh ke banking aur financial system par is mahine ek bada cyberattack hua hai. Economic Times ki jaanch ke anusaar, is mahine ki shuruaat me lagbhag 20 financial institutions — jinme banks, non-banking financial companies (NBFCs) aur fintech firms shaamil hain — hamlaavaron ke nishane par aaye. Hamlaavaron ne partner bank ke chori kiye gaye credentials aur payment aur loan-disburment API (application programming interfaces) ki kamzori ka istemal karke funds nikale. Mamle se judi jaankari rakhne wale logon ne ET ko bataya ki iske baad banks, NBFCs aur fintech firms ne apne payment aur disbursement API ko pratibandhit kar diya.

Ye attack kisi seedhi hacking se alag tha — hamlaavaron ne vaidha (legitimate) financial infrastructure ke zariye hi paisa nikala. Unhe customer verification, loan approval aur transaction limit jaise niyantranon ko bypass karne me safalta mili, kyunki unke paas partner bank ke asli credentials the. Aashanka hai ki nikali gayi rashi ko mule accounts me bheja gaya — aise accounts jo dhokhadhadi ke paise ko chhupane ke liye istemal hote hain. Kuch reports ke mutabik attack me AI-assisted hacking tools ka bhi istemal ho sakta hai, lekin is baat ki abhi pushti nahi hui hai.

Hamle ke baad Bharat ki cybersecurity agency — Indian Computer Emergency Response Team (CERT-In) — ne 9 October ko ek critical advisory jari ki. Advisory me banks, NBFCs aur fintech firms se kaha gaya ki ve affected interfaces ko turant band karein, transaction safeguards ko mazboot karein aur customer verification ko sakht karein. CERT-In ne payment aur disbursement API ki suraksha ko lekar chetaavni di, kyunki yehi woh darwaze hain jinse paisa aata-jata hai.

API woh digital pul hai jisse payment initiation, loan disbursement aur wallet transaction chalte hain. Kamzor API ya chhed wala access control hamlaavaron ko bina adhikaar ke paisa nikalne ka mauka deta hai.

ET ki report ke mutabik hamlaavaron ne ek aisi financial technology platform ki kamzori ka fayda uthaya jo kathit roop se Chennai-based software company ne banayi thi — is platform se kayi financial institutions payment aur disbursement process karte the. Platform ke inadequate security controls ne hamlaavaron ko payment-related functions tak pahunch aur bina adhikrit ke transaction shuru karne ka mauka diya. Technology provider ki pehchaan aur kul financial loss ki rashi ki swatantra roop se pushti nahi ho saki hai.

Digital Threat Report 2025-26 ke mutabik Bharat ke BFSI sector par cyberattack global average se 1.6 guna zyada dar par hote hain — reported incidents 2021 ke 14 lakh se badhkar 2025 me 29 lakh se zyada ho gaye. Mobile aur UPI fraud, AI-generated phishing, deepfake impersonation aur API abuse sabse tezi se badhte khatre ginaye gaye hain.

Is cyberattack ka seedha asar aam khaate-dhaarakon par turant nahi dikha hai — lakshya banayi gayi institutions ke backend systems the, individual customers ke accounts nahi. Phir bhi experts ki salah hai ki log apne bank se aane wale sandeshon ko dhyaan se dekhein, OTP kisi se share na karein, aur account me kisi anjaani transaction ki turant report karein. Financial institutions ko CERT-In ki advisory ke mutabik apne API endpoints ka audit, credential rotation aur maker-checker controls ko sakht karna hoga.

Aane wale dinon me is baat par nazar rahegi ki nishane par aayi institutions ne kaun se thos sudhaar kiye aur hamlaavaron ki pehchaan me jaanch kitni aage badhti hai. Digital India ke daur me jahan har second me lakhon digital transactions hote hain, wahan payment infrastructure ki suraksha ab rashtriya suraksha jitni hi mahatvapurn ho gayi hai. Ek kamzor API kayi institutions ko ek saath khatre me daal sakti hai — ye hi is ghatna ka sabse bada sabak hai.

यह सारांश मीडिया रिपोर्टों पर आधारित है। स्थिति बदल सकती है; ताज़ा जानकारी के लिए आधिकारिक सूत्रों से पुष्टि करें।