India's Cosmos Bank loses $13.5 mln in cyber attack

City Union Bank

14/08/2018 14:37

By Rajendra Jadhav
    MUMBAI, Aug 14 (Reuters) - Cyber criminals hacked the
systems of India's Cosmos Bank and siphoned off nearly 944
million rupees ($13.5 million) through simultaneous withdrawals
across 28 countries over the weekend, the bank has told police.
    The co-operative bank said unidentified hackers stole
customer information through a malware attack on its automated
teller machine (ATM) server, withdrawing 805 million rupees in
14,849 transactions in just over two hours on Aug. 11, mainly
overseas.
    Apart from the ATM withdrawals, the hackers transferred 139
million rupees to a Hong Kong-based company's account by issuing
three unauthorised transactions over the SWIFT global payments
network, the bank said in a police complaint, a copy of which
was seen by Reuters.
    SWIFT, whose messaging system is used to transfer trillions
of dollars a day, said it did not comment on individual cases.
    Cosmos Bank, based in the western city of Pune, said in a
press statement that its main banking software receives debit
card payment requests via a "switching system" but it was
bypassed in the attack.
    "During the malware attack, a proxy switch was created and
all the fraudulent payment approvals were passed by the proxy
switching system," the bank said.
    The bank declined to reveal the countries, citing security
risks.
    Police said they were investigating the theft.
    A police official, who declined to be named, said they had
enlisted the help of experts to find out how authorised
transactions were conducted simultaneously in various countries.
    India's City Union Bank Ltd  CTBK.NS  reported in February
that it had suffered three "fraudulent remittances" of nearly $2
million that had been pushed through the SWIFT financial
platform.  urn:newsml:reuters.com:*:nL4N1Q708P
    In 2016, unknown hackers stole more than $81 million from
the Bangladesh central bank's account with the Federal Reserve
Bank Of New York. Investigators have made little progress in the
case.
    "While there is growing awareness to regularly update an
organisation's cyber preparedness and defence mechanisms, a
large number of institutions wake up to this reality only post
an incident which often leads to a loss of reputation and/or
financial misappropriation," said Nikhil Bedi, a partner with
Deloitte India.
    ($1 = 69.8950 Indian rupees)

 (Reporting by Rajendra Jadhav; Editing by Adrian Croft)
 ((rajendra.jadhav@thomsonreuters.com; +91-22-6180-7153 ;
Reuters Messaging:
rajendra.jadhav.thomsonreuters.com@reuters.net))