Breaches and incidents
Central Bank of India (India): Rs 13.97 crore taken from its RBI settlement account through 187 unauthorised RTGS messages
Per the bank’s police complaint: 6 transfers on 15 Oct, 88 on 16 Oct and 93 on 17 Oct 2026, 187 in all, to 36 recipient accounts.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Per the bank’s police complaint: 6 transfers on 15 Oct, 88 on 16 Oct and 93 on 17 Oct 2026, 187 in all, to 36 recipient accounts. The bank found no trace of them in branches, internet or mobile banking, core banking, RTGS settlement records or its SFMS server. Police found partial records of 10 accounts in SFMS logs without matching transaction IDs, and the payer accounts did not belong to the bank (MediaNama citing Hindustan Times; Outlook Money).
- Root cause: disputed. The complaint alleges unknown persons reached the central SFMS server of IFTAS (an RBI subsidiary) through the bank’s own SFMS server. The bank’s clarification cites “a technical issue observed in the interface environment of localised RTGS server maintained at Bank’s end”. IFTAS said “there is no compromise on any of the systems managed by IFTAS” (as quoted by MediaNama).
- Attacker: unknown. Mumbai’s Nodal Cyber Police registered a case against unknown persons for cheating and personation.
- Response: RTGS restored on all channels; the bank says “no customer account is impacted”. It notified RBI, IFTAS, the DAKSH portal, NCIIPC and CERT-In. No RBI action reported.