A Hyderabad-based non-banking financial company (NBFC) has reportedly suffered a cyber fraud involving more than ₹3.3 crore, allegedly transferred from its bank account through 183 unauthorised transactions within just 87 minutes. The incident has raised serious concerns regarding application programming interface (API) security, automated transaction monitoring, fraud prevention and operational risk management in India’s rapidly expanding digital financial ecosystem.
According to a complaint submitted by the company’s Chief Financial Officer (CFO) to the Telangana Cyber Security Bureau (TGCSB) on 20 October 2026, unidentified cybercriminals allegedly gained unauthorised access to the NBFC’s internal systems and API infrastructure on 19 October. The suspected intrusion occurred between 10:31 a.m. and 11:58 a.m., during which funds exceeding ₹3.3 crore were transferred to 52 suspected beneficiary accounts.
The company detected the breach on the same day and reported the incident through the National Cyber Crime Reporting Portal (NCRP). It subsequently approached the cybercrime authorities seeking an investigation, identification of the perpetrators and freezing of the beneficiary accounts to prevent further diversion of funds.
Following the complaint, the TGCSB registered a case under Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita (BNS), relating to cheating and cheating by personation, along with Sections 43, 66, 66C and 66D of the Information Technology Act.
Preliminary investigations suggest that the attackers may have executed a targeted intrusion and rapidly distributed the funds across multiple bank accounts before the unauthorised activities were detected. Individual withdrawals reportedly ranged between ₹50,000 and ₹2 lakh.
Investigating authorities have sought detailed system and API logs, transaction records, bank statements and the NBFC’s internal incident report to determine the source and sequence of the attack. According to a TGCSB official, approximately ₹40 lakh had been blocked in suspected accounts, while efforts were continuing to trace the remaining funds and identify the persons responsible.
The incident illustrates the potential financial consequences of cyber intrusions involving automated financial systems. Based on the reported figures, the unauthorised activity involved an average of approximately 2.1 transactions per minute, with more than ₹3.79 lakh transferred per minute during the 87-minute period.
For NBFCs and other financial institutions increasingly dependent on digital disbursement platforms, the incident highlights the importance of robust API authentication, transaction velocity controls, behavioural anomaly detection, real-time fraud alerts and automated transaction suspension mechanisms.
It also raises questions about the effectiveness of cybersecurity governance and incident response arrangements, particularly where financial institutions rely on interconnected applications, banking interfaces and external technology service providers.
Although the precise technical vulnerability responsible for the suspected compromise has not yet been established, the case demonstrates how a relatively short period of unauthorised access can translate into substantial financial exposure. Strengthening preventive controls, maintaining forensic readiness and reducing the interval between suspicious activity detection and transaction containment are therefore critical components of financial sector operational resilience.
RMAI Risk Perspective: The incident provides a significant case study in the intersection of cybersecurity, operational risk and financial fraud. Risk management professionals should examine whether their institutions have adequate API access controls, real-time transaction monitoring, automated fraud detection thresholds and incident escalation procedures. Of particular importance is the ability to identify unusual transaction volumes and beneficiary-account patterns quickly enough to interrupt unauthorised disbursements before substantial financial losses occur.
