Banks’ data breaches: India in constant state of digital pandemic; new vaccine needed regularly, say experts

Since July, at least seven banks – including the largest lender State Bank of India -- have been victim to data breaches and cybersecurity attacks, causing critical customer data to be exposed to the Dark Web. The regulator, Reserve Bank of India, since October 19, has issued two advisories to lenders to tighten controls and set timelines for controls.

The deeper concern is that when banks give application programming interfaces (APIs) to non-banking financial companies (NBFCs) – by allowing their core systems to exchange data and allow for transactions linked to loan allocations or forex cards, the APIs are the portion which could be most compromised. Attackers – who rarely use the front door to break in – can hijack these trusted connections to carry out fund transfers or customer details from the bank.

In October 2026, while ICICI Bank's internal servers were not breached directly, cybercriminals compromised the APIs which linked ICICI Bank’s systems to NBFCs. Hackers manipulated these payment gateways to trigger over 700 unauthorised instant loan transfers, stealing approximately $2 million (approx. Rs 17 crore), media reports said.

“Historically, NBFCs, fintechs, have always been the weakest link and soft target,” says Yash Kadakia, founder of Security Brigade, a cyber security company.

Despite the heightened sense of caution, experts say banks, besides large corporates, remain in constant risk of future cyber-attacks. “We are in a constant state of digital pandemic. Whenever the new virus is coming, we have to take a vaccination for it,” says Ritesh Bhatia, founder of V4WEB Cybersecurity, who is a cybercrime investigator, incident response expert and data privacy consultant.

An area of concern

Just after announcing the September-ended quarterly earnings, SBI chairman C.S. Setty called the data breach at the bank – announced on October 21 -- in which some customers’ data was exposed on the dark web, “definitely an issue of concern”. SBI had received alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In on October 16 that its customers’ data was available on the dark web.

Its preliminary analysis of about 3.75 lakh records found 3,897 customer records containing personal information, the Internet Freedom Foundation said in a post on its X account.

“The digital surface area continues to increase,” Setty had told media, adding that the root cause analysis for still being carried out. The exposed information included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and details linked to loan records.

In the case of Bank of Baroda (BoB), a threat actor claimed to have leaked nearly 1TB of sensitive data on the Dark Web. This saw photos, accounts, mobile numbers, addresses, signatures of individuals, home and gold loan data, insurance premium receipts, SIM details, and audit & inspection details of BoB’s customers being leaked out.

The bank has said that the breach traced back to a single compromised employee email account, which gave an unknown party unauthorised access to "certain data". The management has said that its core banking systems, that is, the infrastructure that actually moves customer money, were never compromised.

Bank of Baroda's managing director and CEO Debadatta Chand told analysts on October 30, that in terms of investment, Bank of Baroda strengthened the security architecture on the entire cyber mechanism, strengthening system, oversight control, governance. “It was a wakeup call for us to revamp everything that we have done, we have almost 10% of the operating profit earmarked for IT. Chand had directed the bank’s IT department to go “up to 15%”.

In the case of Central Bank of India , between October 15-17, Rs13.97 crore vanished from the bank’s accounts through a series of highly sophisticated, unauthorized transfers. They bypassed the core banking system and gave forged payment instructions into the Bank’s structured financial messaging system (SFMS). Media reports said that police said a server of Indian Financial Technology and Allied Services, a subsidiary of the RBI was hacked. The Bank said no customers’ accounts were compromised and the core banking system was intact.

In recent media reports, the Banker, a banking publication of the Financial Times group on November 13, alleged that private sector lender YES Bank had suffered a loss of $3.4 million (Rs 32 crore) in a cyber fraud incident involving government accounts in October. YES Bank has called the report “factually incorrect” and said it has suffered no financial loss and the bank’s systems have not been compromised.

There have been other data breach instances reported across the globe: This month French lender Credit Mutuel Arkea told media that hackers had stolen around € 100 million in a cyber attack on the bank. Reuters had reported that the attackers used an account belonging to Credit Mutuel Arkea to carry out "fraudulent ⁠transactions", based on the statement from the French bank. The funds were not in the form of cryptocurrency, the bank said, but could have been converted to crypto after being stolen.

In Japan, around 128 Shinkin Banks (credit cooperatives) witnessed a technical disruption, where customers were unable to carry out transactions and withdraw money from ATMs. Nippon.com reported that the system failure was caused by an equipment malfunction, not a cyberattack.

The RBI in its October 19 advisory, said the regulated entities should treat their technology environment as compromised if credentials are exposed or unauthorised access is confirmed. The affected systems should remain under that assumption until they are cleared through a forensic investigation.

The advisory follows warnings from the Indian Computer Emergency Response Team (CERT-In) over cyberattacks targeting NBFCs, fintech companies, payment service providers and other financial entities. CERT-In had flagged the use of stolen credentials, exposed payment APIs and weaknesses in internet-facing systems in attacks involving unauthorised fund transfers.

Bhatia of V4WEB Cybersecurity said that the cybersecurity ecosystem has changed completely due to the growth and usage of AI. “It is very easy not only just to defend yourself, but also to attack.”

He said that since banks have become so technology-oriented, they have had to constantly depend on regular, updated patching, strengthening system passwords and having to think out-of-the-box to tackle rapidly evolving risk management issues.

Kadakia of Security Brigade said that from a regulatory perspective, whatever they have done for banks will start to apply to NBFCs and fintechs as well, which is what it should be.” He also added that strengthening of technology platforms for fintechs is not a complex problem to solve. They'll all have to figure that out.

Kadakia foresees that India will see “smaller incidents taking place where some data system or some marketing system will get compromised because its a footprint issue. Fintechs might have been slow earlier to strengthen cybersecurity platforms, but I think now they're all moving in the right direction, Kadakia said.

SBI chairman C.S. Setty post the bank’s September-ended quarterly earnings had said that cyber resilience is another area which the bank was investing for the future. The recently inaugurated SBI CyRIS, our Cyber Resilience, Integrity, and Security Center of Excellence, will strengthen SBI’s capabilities while facilitating greater collaboration and knowledge sharing across the BFSI ecosystem.