Ransomware attack hits 300 banks: all you need to know

A ransomware attack on C-Edge Technologies, a major banking technology provider in India, on Wednesday caused a temporary shutdown of payment systems at nearly 300 small local banks.

The Mumbai-based technology company is in the advanced stage of hiring a forensic auditor to look into the matter, said people familiar with the development. After the attack, the National Payments Corporation of India (NPCI) disconnected all forms of retail payment service offered to the company.

What happened next


C-Edge had hired Brontoo Technology Solutions to deploy connectivity with Bharat Bill Payment System (BBPS). For this Brontoo was using Amazon Cloud Server, from where the attack could have likely emanated, people in the know said.

Taking to social media platform X, NPCI issued an advisory on July 31 stating, “To prevent a larger impact on the payment ecosystem, NPCI has temporarily isolated C-Edge Technologies from accessing the retail payment systems operated by NPCI.”

"Customers of banks serviced by C-Edge will not be able to access payment systems during the period of isolation," the NPCI added.

The country’s payment system overseers are now conducting a through audit to prevent the attack from spreading further.

Impact

It is estimated that online payment services of over 100 cooperative banks were disrupted.

India has a large network of around 1,500 cooperative and regional banks, mainly catering to customers outside major cities. These smaller institutions have been the ones impacted by the ransomware attack.

The Reserve Bank of India (RBI) and Indian cybersecurity authorities had previously issued warnings to banks about the potential for cyberattacks in recent weeks.

Industry reaction

“In terms of overall volume impact it will be less than 1%, but NPCI had to isolate its systems to ensure the larger banking ecosystem is safe,” a senior banker in the know told ET. “The restoration work has already started.”

Cost impact
An IBM report showed that the average cost of a data breach touched all-time high of Rs 19.5 crore ($2.35 million) in financial year 2024, up by around 7% over a year ago, with the local industrial sector being the most impacted, ET reported on July 31.