Breaches and incidents
Hyderabad NBFC, unnamed (India): Rs 3.3 crore drained through its systems and API in 87 minutes
Per the CFO’s complaint to the Telangana Cyber Security Bureau (TGCSB).
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Per the CFO’s complaint to the Telangana Cyber Security Bureau (TGCSB): on 19 Oct 2026 between 10:31 and 11:58, unidentified persons gained unauthorised access to the company’s systems and API and made 183 unauthorised transfers of Rs 50,000 to Rs 2 lakh each, more than Rs 3.3 crore in all, to 52 suspected beneficiary accounts (Siasat citing Times of India; RMA India).
- Root cause: not established; reported only as unauthorised access to internal systems and API infrastructure. The pattern matches CERT-In advisory CIAD-2026-0046 (see the 9 Oct 2026 entry), but no source links them.
- Attacker: unidentified. Case under BNS 318(4) and 319(2) and IT Act sections 43, 66, 66C and 66D.
- Response: reported on the National Cyber Crime Reporting Portal; complaint filed 20 Oct; about Rs 40 lakh blocked in suspect accounts, per a TGCSB official.