India’s growth in the digital arena is inviting a lot of unwanted attention from cybercriminals and malicious insiders. Though companies are stepping-up surveillance and cybersecurity measures to combat threats, cyber-attacks continue to grow due to poor awareness among employees and newer malware created by hackers. Software vulnerabilities remain irrespective of stringent measures. Kaspersky exposed 8.3 crore cyber threats in the April-June quarter of 2021, an increase from 3.7 crore threats detected in January-March quarter.
The spread of the Covid-19 pandemic has also encouraged attackers to take advantage of the situation and breach confidential data. In 2021, India was reported to be among the top three nations that experienced maximum server breaches and ransomware attacks in Asia. In the insurance sector, ransomware was the buzzword in 2021, as attacks continued to grow in magnitude and complexity.
As organizations in the financial sector prepare to look forward, it may help to look back at the top cyberattacks seen by the BFSI sector in India in 2021.
- January 2021: Juspay customer card details leak
Leading fintech company Juspay reportedly compromised customer data of over 100 million customers, according to claims made by security researcher Rajshekhar Rajaharia. As per claims, an attacker released two sets of data on the Dark Web, containing email addresses and contact details of 100 million customers and 46 million card transaction details. Defending the same, Juspay said that it had suffered a data breach in 2020, which impacted an isolated storage unit that didn’t have any sensitive or private customer information. These cyber-attacks are known to be the largest that the Indian digital payment infrastructure has experienced, and the RBI swung into action to curb cyberattacks as a result.
- March 2021: Mobikwik customer KYC data put up for sale on the Dark Web
Rajaharia claims that in March, a large chunk of data containing sensitive KYC information of mobile wallet company Mobikwik was put up for sale to hackers on the Dark Web. The leaked data allegedly included Aadhaar numbers, names, GPS locations, credit and debit card credentials and mobile numbers of about 3.5 million customers. Though MobiKwik refuted any data breach claims, the leak was confirmed by other security researchers such as French ethical hacker Robert Baptiste and Australian security researcher Troy Hunt. Mobikwik, in its defence, threatened to take legal action against the researcher who first flagged the data breach, completely denying its occurrence.
- PNB server vulnerability exposes financial data
Cybersecurity firm CyberX9 allegedly found a software vulnerability in the exchange servers of the renowned public sector undertaking, Punjab National Bank (PNB) and claimed that the confidential financial information of close to 180 million customers was left exposed for seven months. PNB admitted that there was a vulnerability but denied claims that customer data was exposed because of the same. PNB also reported that the compromised servers didn’t contain any private customer information and that the cybersecurity measures already in place had done what they had to when the threat was found.
Security researchers claim that the threat posed by ransomware, malware, and zero-day attacks are not going to subside anytime soon. According to cybersecurity firm Trend Micro, 73% of organizations in India are anticipating data breaches involving customer data in the next year. Maya Horowitz, VP of Research at Check Point Software, warned in a blog post, “The sophistication and scale of cyber-attacks will continue to break records, and we can expect a huge increase in the number of ransomware and mobile attacks.”
Even though organizations have been tightening the noose as far as the cybersecurity infrastructure is concerned, the likelihood of data breaches is only increasing. However, this does not mean that incidents cannot be controlled and that individuals and organizations will always have to succumb to the hands of malicious cyber attackers. Stringent measures should still be put in place to protect its own reputation and all the beneficiaries to which the organization is answerable. Implementing latest technology, promptness and efficacy in the cybersecurity measures are certain to keep a check on the number of incidents taking place.
About SNS
Secure Network Solutions (SNS) provides a quantifiable, risk-based approach to building a global structure of cybersecurity, based on internationally recognized frameworks and practices. We have been providing services and catering to clients across industries for the last 20 years. Write to us at [email protected].
