India’s Cosmos Bank loses $13.5 mln in cyber attack

Cyber criminals hacked the systems of India’s Cosmos Bank and siphoned off nearly 944 million rupees ($13.5 million) through simultaneous withdrawals across 28 countries over the weekend, the bank has told police, according to Reuters.

The co-operative bank said unidentified hackers stole customer information through a malware attack on its automated teller machine (ATM) server, withdrawing 805 million rupees in 14,849 transactions in just over two hours on Aug. 11, mainly overseas.

Apart from the ATM withdrawals, the hackers transferred 139 million rupees to a Hong Kong-based company’s account by issuing three unauthorised transactions over the SWIFT global payments network, the bank said in a police complaint, a copy of which was seen by Reuters.

SWIFT, whose messaging system is used to transfer trillions of dollars a day, said it did not comment on individual cases.

Cosmos Bank, based in the western city of Pune, said in a press statement that its main banking software receives debit card payment requests via a “switching system” but it was bypassed in the attack.

“During the malware attack, a proxy switch was created and all the fraudulent payment approvals were passed by the proxy switching system,” the bank said.
The bank declined to reveal the countries, citing security risks.

A police official, who declined to be named, said they had enlisted the help of experts to find out how authorised transactions were conducted simultaneously in various countries.