Loading story…
India’s .bank.in domain program, launched to improve trust in banking websites and reduce phishing, was hit by allegations that the registration portal run by the Institute for Development and Research in Banking Technology (IDRBT) exposed sensitive data through more than 33 unauthenticated REST API endpoints. Researcher Srikanth L of CashlessConsumer reported that the flaws could have exposed information tied to 5,576 bank employees responsible for managing banking domains, including bcrypt password hashes, mobile numbers, email addresses, login IP addresses, and device fingerprints.
The reported exposure raised concerns that attackers could use the leaked information for impersonation, phishing, and DNS-related attacks against Indian banks. The researcher said the portal remained insecure for about 13 months and lacked a proper security audit, while many .bank.in domains were also found to have weak security hygiene, including limited adoption of DNSSEC and DMARC and, in some cases, hosting on shared international servers. IDRBT reportedly fixed the exposed API flaws after disclosure, while public responses from IDRBT, the Reserve Bank of India, and the Indian government were not available at the time of reporting.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
After the disclosure, IDRBT reportedly remediated the exposed API vulnerabilities in its Domain Registration Portal.
According to Srikanth L, the exposed API issue affecting the .bank.in registrar portal was disclosed to IDRBT in early June 2026.
Researcher Srikanth L alleged that IDRBT's .bank.in Domain Registration Portal exposed more than 33 unauthenticated API endpoints for 13 months without a proper security audit, risking access to sensitive data on 5,576 bank employees.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Reserve Bank of India (RBI) has mandated that all banks and financial institutions migrate their websites to the exclusive ".bank.in" domain, aiming to combat rising digital fraud, phishing scams, and cyber-attacks targeting the Indian banking sector. This move is designed to prevent domain spoofing, enhance customer trust, and strengthen the overall cybersecurity posture of the financial ecosystem by ensuring only RBI-approved banks can register these domains, implementing DNSSEC, and enforcing strict encryption standards. The initiative aligns with global best practices and is expected to significantly reduce cyber fraud associated with fake banking websites. Simultaneously, the Digital Personal Data Protection (DPDP) Act, 2023, is reshaping data governance in India's Banking, Financial Services, and Insurance (BFSI) sector. The Act grants customers greater control over their personal data, including rights to access, correct, and request deletion, and mandates informed, granular consent for data collection and sharing. With the average cost of a data breach in India reaching US$2.18 million in 2023 and customer skepticism on the rise, these regulatory measures are positioned as critical steps to restore trust, ensure transparency, and provide a competitive advantage for institutions that proactively comply.
Jun 29, 2026
Bank of Baroda has confirmed a cybersecurity incident after threat actors claimed to have stolen and published sensitive bank data online. The bank said a compromised employee email account enabled unauthorized access to certain data, but added that its core banking systems were not accessed and that the incident was detected and contained quickly. Public reporting said leaked samples and directory listings appeared to include internal documents, customer onboarding records, audit materials, internal emails, loan documents, and corporate banking files, although the authenticity and full scope of the exposed data have not been independently verified. Researchers tracking darknet activity said the stolen material was advertised for sale on underground forums and a Telegram channel by an actor identified in separate reports as **"leak-king-F"** and publicly linked elsewhere to **Triple X**. One report described the cache as roughly **1 TB** of data spanning retail, corporate, and digital banking operations, while also noting an unverified claim that the breach stemmed from a weak password. Bank of Baroda had not confirmed customer-data exfiltration, and the incident raised concerns over fraud, phishing, and follow-on attacks if internal security and audit documents were exposed.
Jul 30, 2026
A new online tool and Telegram bot called Proxyearth has emerged, enabling anyone to obtain highly sensitive personal information about Indian citizens using only their mobile phone number. Testing by security researchers confirmed that the tool provides accurate and up-to-date details, including full name, father's name, email address, telecom provider, home address, alternate phone numbers, and even Aadhaar card numbers. The service, launched in October 2025, appears to aggregate data from previously breached KYC records, leaked Aadhaar databases, and other state-linked sources, raising significant privacy and security concerns. The existence of Proxyearth poses a severe threat to national security, as it allows for large-scale surveillance, profiling, and potential targeting of individuals, including government officials, law enforcement, and journalists. The tool's ability to pinpoint exact locations and expose comprehensive identity information highlights the ongoing risks associated with massive data breaches in India and the exploitation of sensitive government and telecom records. Authorities are being urged to investigate the source of the data and take immediate action to mitigate the threat posed by this tool.
Jun 29, 2026