Cyber attack on technology provider to nearly 300 small banks in India

A ransomware attack on a technology service provider for nearly 300 small and rural cooperative banks across India, forced a temporary shutdown of payment systems across nearly 300 small and rural banks.

The National Payments Corporation of India (NPCI) announced via its X handle post on Wednesday evening that C-Edge Technologies, which primarily supports cooperative and regional rural banks, has been targeted by a ransomware attack.

C-Edge, a joint venture between state-owned State Bank of India and private Tata Consultancy Services, serves cooperative banks and regional rural banks which have been hit by the cyber security attack.

Officials stated that other banking services remained unaffected. To protect the broader payments system, necessary precautions, including isolating the C-Edge system, had to be implemented following the breach noticed two days ago.

An industry official told news agency PTI that the ransomware was detected and isolated within the system, prompting a third-party audit.

The official said the affected banks represent less than one percent of the total payment system volume in the country.

To guard against further risks to the payment infrastructure, NPCI has temporarily cut off C-Edge Technologies from its retail payment networks. As a result, customers of banks relying on C-Edge’s services are currently unable to access payment systems.

NPCI said in a statement that "C-Edge Technologies has been possibly impacted by a ransomware attack impacting a few of their systems," leading to the temporary isolation of C-Edge from accessing NPCI-operated retail payment systems. All online transactions, such as RTGS and UPI payments, are affected.”

Dileep Sanghani, chairman of the National Cooperative Union of India, said nearly 300 banks that rely on C-Edge, have been facing issues for the past two to three days.

"All online transactions, such as RTGS and UPI payments, are affected. Money is deducted from the sender's account but does not get credited in the receiver's account," Sanghani said.