A major cyber fraud has hit a Hyderabad-based non-banking financial company (NBFC). Cybercriminals allegedly gained access to the company’s systems and its application programming interface (API). They then moved out more than Rs 3.3 crore from the company’s bank account in just 87 minutes.
According to the complaint filed with police, the suspicious transactions took place on October 19, between 10:31 am and 11:58 am. During this period, money was transferred 183 times and sent to 52 suspicious bank accounts. On average, more than two transactions took place every minute. Individual transfers ranged from Rs 50,000 to Rs 2 lakh.
An NBFC provides loans and other financial services. An API is a digital link that lets two software systems share information and work according to set instructions. Finance companies use APIs to connect different digital services and systems. Unauthorised access to such a link can allow misuse if security is bypassed.
How the criminals entered the company’s systems and API is not yet clear. It is also not known which weaknesses they exploited. Investigators have asked for the company’s system logs, API logs, transaction records, bank statements and internal reports. Agencies are tracing where the money went, where it was sent next and who is behind the network.
The company’s Chief Financial Officer (CFO) filed a complaint with the Telangana Cyber Security Bureau (TGCSB) on October 20. The complaint sought an investigation into the cyberattack, identification of those responsible and freezing of the suspicious accounts. The company also reported the case on the National Cyber Crime Reporting Portal the same day. Investigators have since started collecting transaction records and digital evidence.
A TGCSB official said that about Rs 40 lakh has been frozen in the suspicious accounts so far, so that it cannot be withdrawn or transferred. Against the alleged loss of over Rs 3.3 crore, a large part of the amount remains under investigation. The probe is continuing.
