Hiding behind a veil of silence: It took banks 6 weeks to report the breach

MUMBAI: Banks knew about the debit card security breach six weeks ago and greater alacrity about reporting the matter to the police and the banking regulator may have minimised its impact, experts said.

The RBI and National Payments Corporation of India (NPCI), the nodal agency that links all ATMs, are trying to estimate the extent of the damage due to the cyber attack. Banks are replacing debit cards or asking customers to change their PINs. Some sources said the malware used was highly advanced and capable of lying undetected for a long period of time.

“The malware that is suspected to have affected the systems is said to be so advanced that it deleted itself, thereby not leaving any trace of its presence, which caused banks to take six weeks to detect the issue," said ATM industry insiders who didn't want to be named.

“However, the final confirmed details will only emerge once the forensic audit is completed.“ The possibility of an insider who played a role in installing the bug may be considered by probers.

Hitachi Payment Services denied that the malware infection originated from its systems. “The interim report published by the audit agency in September, does not suggest any breach compromise in our systems. The final report is expected by mid-November,“ said MD, Loney Antony.