Breaches and incidents
Flexypay Solutions (India): Hyderabad fintech’s servers used to send API payout requests to Yes Bank from whitelisted IPs, Rs 1.4 crore lost
During an internal audit on 15 Sep 2025 the bill, rent and education payments firm found unauthorised transactions of Rs 1,39,95,215.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- During an internal audit on 15 Sep 2025 the bill, rent and education payments firm found unauthorised transactions of Rs 1,39,95,215; CEO Gadde Chandrasekhar filed a complaint on 22 Sep (Siasat).
- Root cause per the complaint: hackers accessed the company’s servers, sent API requests to its partner bank Yes Bank and routed funds to multiple accounts “through whitelisted IP addresses”. The database was not breached; the server infrastructure was misused. Two unlisted IPs were blocked, but requests from the whitelisted IPs were processed as legitimate.
- Attacker: unknown; case by Hyderabad city cybercrime police under the IT Act and BNS.
- Response: partner Juspay helped investigate and supplied logs of suspicious IPs.