Breaches and incidents
Nupay (India): public S3 bucket exposed 273,000 NACH bank-transfer forms naming 38 lenders
UpGuard found on 26 Aug 2025 a public Amazon S3 bucket with 273,160 PDFs (about 210 GB) of NACH transaction forms.
- Disclosed
- Verification
- Checked against a primary source
What happened
- UpGuard found on 26 Aug 2025 a public Amazon S3 bucket with 273,160 PDFs (about 210 GB) of NACH transaction forms: account numbers, amounts, bank codes, names, phone numbers and emails, with about 3,000 files added daily. In its sample Aye Finance appeared in 59.63% of files and State Bank of India in 24.22%. The bucket address was indexed by Grayhatwarfare (TechCrunch).
- Root cause: fintech Nupay confirmed it “addressed a configuration gap in an Amazon S3 storage bucket”, calling the contents a “limited set of test records” and “a majority were dummy or test files”. UpGuard disputes this.
- Attacker: none named. Nupay says its logs show no unauthorized access.
- Response: UpGuard notified Aye Finance (27 and 28 Aug), NPCI (29 Aug) and CERT-In (2 Sep, automated reply); the bucket was secured by 4 Sep. NPCI said the data did not come from its systems; Aye Finance denied being the source.