Breaches and incidents
Western Capital Advisors (India): Rs 18.96 crore drained through ICICI Bank payout APIs wired into its loan-origination vendor OneFin
NSE filing of 10 Oct 2026: 695 unauthorised IMPS debits totalling Rs 18,96,07,563 from five ICICI Bank current accounts, from 07:26 IST on 8 Oct to 12:40...
- Disclosed
- Verification
- Checked against a primary source
What happened
- NSE filing of 10 Oct 2026: 695 unauthorised IMPS debits totalling Rs 18,96,07,563 from five ICICI Bank current accounts, from 07:26 IST on 8 Oct to 12:40 IST on 9 Oct (per bank statement). No customer loss identified; no material impact on operations.
- Root cause per the filing: “Abnormal server/API activity and unauthorised payout transaction attempts through ICICI Bank payout APIs integrated with the LOS technology service provider, OneFin platform.” Remediation listed: payout API keys revoked, access restricted to the head-office IP, “permissive WAF rules removed”, AWS IAM/CLI credentials disabled and “vulnerable endpoint patched”. The specific vulnerability is not named.
- Attacker: “Unidentified individuals, unrelated to the entity” (filing).
- Response: reported to RBI on DAKSH, to the National Cyber Crime Reporting Portal (9 and 10 Oct) and to CERT-In (9 Oct); bankers asked to recall and freeze beneficiary accounts; ICICI Bank asked to disable the payout APIs and apply a debit freeze.