Cyberattacks on Indian Banks: What Went Wrong and What Regulators Require

Hero Summary

Two of the most widely documented cyberattacks on Indian banks — the 2016 attempt to send about $171 million through Union Bank of India's SWIFT system and the 2018 malware attack on Cosmos Bank's ATM switch, which caused a loss of roughly ₹94 crore — show the same pattern: attackers exploited a gap in security controls or staff awareness, and detection and containment determined the outcome. The Reserve Bank of India (RBI) set out cybersecurity requirements for banks in response to this class of attack, and CERT-In separately requires cyber incidents to be reported within six hours.

Executive Summary

Banks are high-value targets because they hold money and sensitive customer data and run complex, interconnected payment infrastructure. This guide reviews two well-documented incidents using public reporting and an RBI press release, draws out the control failures they point to, and summarizes the regulatory requirements that apply to Indian banks and what a practical response looks like. Details of both incidents come from news reporting and regulatory statements, and some figures differ between sources; where they do, this guide says so.

Why banks are targeted {#why}

Banks combine direct access to funds with large volumes of personal and financial data, and their payment systems — core banking, ATM and card switches, and the SWIFT interbank messaging network — connect to many external parties. A compromise that reaches any of these can convert directly into financial loss, which makes banks, including cooperative and smaller banks with fewer security resources, attractive targets.

Case study: Union Bank of India (2016) {#union-bank}

In July 2016, a Union Bank of India employee opened an email attachment that appeared to come from India's central bank. The attachment launched malware that captured the bank's access codes for SWIFT, the system lenders use for international transfers. Those codes were used to send transfer instructions of about $170 million to a Union Bank account at a bank in New York. Reporting at the time said the bank traced the money trail and blocked the funds from moving; the method resembled the earlier Bangladesh Bank heist.

The RBI later examined the bank's cyber security framework. In a press release dated July 15, 2019, the RBI stated that, based on reports of "seven fraudulent messages of a total value of 171 million USD through SWIFT system of the bank in 2016," an examination "revealed several deficiencies," and it imposed a penalty of ₹10 lakh for non-compliance with its cyber security directions for banks.

What it shows: a single phishing email reached an employee whose environment gave attackers a path to payment-messaging credentials. The incident links an awareness failure to a controls failure — and the regulator treated the underlying control gaps as the issue.

Case study: Cosmos Bank, Pune (2018) {#cosmos}

In August 2018, attackers compromised Cosmos Co-operative Bank's systems in a coordinated attack. Public reporting describes malware on the server that connects the bank to the Visa and RuPay card networks (the ATM switch), allowing fraudulent card transactions to be approved without the normal checks. Cloned debit cards were used to withdraw cash at ATMs abroad and in India, and a separate set of fraudulent SWIFT transfers followed. Reporting put the total loss at about ₹94 crore — roughly ₹80 crore from card withdrawals and about ₹14 crore from the SWIFT transfers — though sources differ on exact figures and on the number of countries involved, which reports give anywhere from the low twenties to 28.

The bank stated that its core banking system was not breached; the malware affected the switch environment. A court in Pune later convicted 11 people in the case, according to reporting.

What it shows: the weakness was in a peripheral payment system rather than the core banking platform, and the fraud scaled quickly because card transactions were authorized without effective independent checks. It illustrates why the systems around core banking need the same monitoring and controls as the core itself.

What these incidents have in common {#common}

• A human or process entry point. One began with a phishing email; the other involved compromise of a connected payment system.
• Critical payment infrastructure reachable from the compromised environment, with insufficient segmentation or independent verification.
• Speed. Losses accumulated, or nearly did, within hours, so detection time mattered as much as prevention.
• Controls the regulator later examined. In the Union Bank case, the RBI's examination of its cyber security framework led to a penalty.

What regulators require {#regulation}

• RBI. The RBI's Cyber Security Framework for banks (2016) set baseline controls and requires incident reporting to the RBI, and its Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (issued November 7, 2023) consolidates and updates the RBI's IT governance, risk, and assurance instructions for banks and other regulated entities. Banks should confirm the current incident-reporting timelines and scope in the RBI's directions.
• CERT-In. CERT-In's April 2022 directions require covered entities to report specified cyber incidents to CERT-In within six hours of noticing them, and to retain system logs for 180 days.
• Customer data protection. Banks must protect customer data they hold and that is processed by third parties on their behalf, which makes vendor and outsourcing security part of the bank's own responsibility. India's Digital Personal Data Protection Act adds privacy obligations — see What Is DPDP?.

For the broader regulatory picture, see the Banking Compliance Guide.

A practical defense checklist {#checklist}

1. Train staff against phishing and test it. Include customer-care, finance, and payments teams, and rehearse reporting a suspicious email. See Phishing Attacks: Types, Warning Signs & Prevention.
2. Segment payment infrastructure — SWIFT, ATM and card switches, and core banking — and restrict what can reach them.
3. Require independent verification and dual control for high-value payment messages.
4. Monitor continuously. Round-the-clock monitoring and correlated alerting shorten the time between compromise and response.
5. Test regularly. VAPT of internet-facing and internal systems, including payment-connected systems, finds weaknesses before attackers do.
6. Prepare an incident plan that covers regulator and CERT-In reporting timelines and has been rehearsed.
7. Manage vendors. Extend security requirements and assurance to third parties that handle customer data or connect to bank systems.

How Threat ResQ fits {#threat-resq-fit}

Threat ResQ's products and services map to this checklist. TRISA and its TRAP simulation capability address phishing awareness. SOC+, Threat ResQ's managed detection and response platform, provides 24x7 monitoring and alert triage by a live analyst team, with correlated detection across endpoint, network, and identity signal. The VAPT service covers vulnerability assessment and penetration testing, delivered in collaboration with a CERT-In empanelled security firm, and the Incident Response service covers response when an incident occurs. getTRAC automates evidence collection and control mapping across frameworks including RBI-CSF and CERT-In for India.

FAQ {#faq}

What happened in the Union Bank of India SWIFT attack? In 2016, malware delivered by an email attachment that appeared to come from India's central bank captured the bank's SWIFT access codes, which were used to send fraudulent transfer instructions of about $170 million. The bank stopped the funds, and the RBI later penalized it ₹10 lakh for non-compliance with its cyber security directions.

How did the Cosmos Bank attack work? Attackers used malware on the server linking the bank to the Visa and RuPay card networks to approve fraudulent card transactions without normal checks, then withdrew cash with cloned debit cards at ATMs abroad and in India, followed by fraudulent SWIFT transfers. Reported losses were about ₹94 crore.

What does CERT-In require after a cyber incident? CERT-In's April 2022 directions require covered entities to report specified cyber incidents within six hours of noticing them, and to keep ICT system logs for 180 days.

What does the RBI require of banks on cybersecurity? The RBI's Cyber Security Framework for banks and its 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices set baseline controls, governance, and assurance expectations, including reporting of cyber incidents to the RBI. Confirm current timelines in the RBI's directions.

Are small and cooperative banks also required to meet these standards? RBI cybersecurity requirements apply across regulated banks, with the specific obligations depending on the category of bank. Smaller banks often have fewer security resources, which is why managed monitoring and regular testing are common ways to close the gap.