In a first-of-its kind mind-boggling cyber theft witnessed in the country, a group of international hackers broke into the servers of the Pune-based Cosmos Cooperative Bank ltd and siphoned off a staggering Rs 94.42 crore in a short span of seven to eight hours spread over two days.
The miscreants hacked the payment gateways of the second oldest and largest co-operative bank in the country between 3 pm and 10 pm on August 11 and once again at around 11.30 pm on August 13 and walked away with Rs 94.42 crore through nearly 15,000 ATM transactions.
After launching a malware attack on the bank’s ATM Debit payment server and creating proxy switch server which passed on fraudulent payment approvals, the miscreants withdrew Rs 78 crore through multiple swipes using cloned ATM card details in 28 countries across the world.
The initial investigations have revealed that the suspected malware attack has originated from Canada, Hong Kong and India. The miscreants used at least 30 ATMs to siphon off the money from the bank.
The initial stock-taking by the 112-year-old co-operative bank has revealed that “approximately Rs 78 crore was withdrawn through various ATMs located in 28 countries through 12,000 VISA transactions” and “another Rs 2.5 crore was withdrawn through 2,800 debit card transactions at various locations in India”.
In its complaint lodged with Pune’s Chatshrungi police station, the Cosmos bank stated that Rs 80.5 crore was initially transferred to a foreign bank in 14,849 transactions of the debit card, and another Rs 13.92 crore transferred in a SWIFT transaction.
After the first attack on the bank’s server on August 11, the hackers left a deposit trail in Hong Kong where an amount of Rs 78 crore was transferred, while another transaction of Rs 2.5 crore was also done in India through National Payments Corporation of India (NPCI) and VISA.
During the second attack carried out on August 13, the hackers reportedly transferred at least Rs 13.92 crore to the account of AlM Trading limited at Hang Seng Bank in Hong Kong.
Talking to the media in Pune, Cosmos Bank Chairman Milind Kale said, “We have appointed a professional forensic agency to investigate this malware attack. It will submit its report in the next few days regarding the modus operandi of this and the exact amounts involved.”
Kale pegged the total number of ATM cards compromised at around 450. Using the details of ATM cards obtained during the hacking, the miscreants made multiple withdrawals from each card and the final siphoned off money stands at Rs 94.42 crore.
“let me assure the customers that money lost by way of fraudulent transactions has not been debited to any of the customers’ account and will not be debited in future,” Kale said.
“As it is a malware attack on the switch which is operative for the payment gateway of VISA/Rupay Debit card and not on the core banking system of the bank, the customers’ accounts and the balances are not at all affected... The savings, term deposits and recurring accounts of the depositors are totally safe. I appeal to our customers to remain calm, not to panic and to continue to have faith and trust on the 112-year-old bank,” Kale said.
According to Kale, the bank came to know about the malware attack on its debit card payment system on August 11, when it was observed that unusually repeated transactions were taking place through ATM VISA and Rupay Card for nearly two hours.
“As soon suspicious transactions were reported, we shut our VIS and Rupay Debit card payment system. The core Banking System (CBS) receives debit card payment requests via switching system. ... We observed that approximately Rs 78 crore was withdrawn through various ATSW located in 28 countries involving 12,000 VISA transactions while another Rs 2.5 crore was withdrawn through 2,800 debit card transactions at various locations in India,” Kale said
“Given the sensitive nature of investigations, we cannot disclose the countries, the name of the banks or ATMs locations as it may jeopardise the probe,” Kale said.
Having registered under Section 43, 65, 66(C) and 66 (D) of the Information Technology Act and relevant sections of Indian Penal Code, the Pune police crime branch sleuths are investigating the unprecedented cyber crime.
Alluding to the data security and other systems in the bank, the bank said in a statement. “Every year the server and other systems of the bank are inspected during RBI's audit and system audit. Cosmos Bank is ensuring all the measures for data security and as such the security mechanism is fully operational in the bank.”
