A major cyber fraud occurred at one of the Non-Banking Financial Companies (NBFC) in Hyderabad. The perpetrators managed to gain access to the company's systems and its Application Programming Interface (API). As a result, over 3.3 crore rupees were withdrawn from the company's account in just 87 minutes, involving 183 transactions, with funds transferred to 52 suspicious accounts.
Currently, only about 40 lakh rupees have been frozen, meaning a significant portion of the alleged stolen amount is still under investigation.
This incident took place at an NBFC that provides lending and other financial services. According to the statement filed with the police, continuous suspicious transactions were made from the company's bank account between 10:31 AM and 11:58 AM on October 19. A total of 183 transfers were executed, moving over 3.3 crore rupees to various accounts.
Analyzing the data makes it clear: 87 minutes, 183 transactions, and 52 bank accounts. On average, this meant more than two transactions per minute. Initial investigations suggest that the funds were quickly distributed across multiple accounts. Police reported that the amount of each individual payment ranged from 50 thousand to 2 lakh rupees.
Investigative bodies are currently determining which specific accounts received the money, where it was subsequently redirected, and who is behind the entire network.
A crucial aspect of this case is how the attackers gained access to the company's system and its API. An API is a digital channel through which two software or systems exchange information and operate according to predefined instructions. In financial companies, APIs are used to connect various digital services and systems.
If any person or group gains unauthorized access to such systems and successfully bypasses security measures, it can be misused. However, the method of the hack in this case—what vulnerabilities were exploited by the criminals and how they managed to access the system—has not yet been determined.
Therefore, the company has requested system logs, API logs, transaction records, bank statements, and internal reports as part of the investigation.
The main question in this case is exactly where the millions of rupees went. According to an official from the Telangana Cyber Security Bureau (TGCSB), approximately 40 lakh rupees have been frozen in suspicious accounts so far to prevent their withdrawal or transfer.
Comparing the fraud amount, exceeding 3.3 crore rupees, with the frozen 40 lakh rupees shows that the majority of the damage is still under intense scrutiny by investigators. The company's Chief Financial Officer (CFO) filed a complaint with the Telangana Cyber Security Bureau on October 20. This complaint requested an investigation into the cyberattack, the identification of the responsible parties, and the freezing of suspicious accounts. On the same day, the company notified the incident via the National Cybercrime Reporting Portal.
Following this, investigative agencies began collecting digital evidence and records related to the transactions. The investigation is ongoing. The company faces an estimated loss of over 3.3 crore rupees, with only about 40 lakh rupees known to be frozen.