Breaches and incidents
Aditya Birla Capital Digital (India): API tampering sold digital gold from 435 customer accounts
On 9 Jun 2025 someone sold the digital gold of 435 customers on the ABCD app and moved the money to several bank accounts; estimated loss Rs 1.95 crore.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- On 9 Jun 2025 someone sold the digital gold of 435 customers on the ABCD app and moved the money to several bank accounts; estimated loss Rs 1.95 crore. Customers reported unauthorised sales to the helpline and received MMTC-PAMP sale messages (The Week; Angel One news).
- Root cause per the FIR: an unknown person “hacked the application programming interface (API)” and altered the app’s normal process. How the OTP approval was bypassed is not explained.
- Attacker: unknown; FIR at Mumbai’s Central Region Cyber Police under BNS 318(4) and 319(2) and the IT Act; no arrests reported.
- Response: digital gold service halted, transfers frozen, holdings restored, flaw fixed; working with CERT-In and cyber insurers.