A Hyderabad-based non-banking financial company has reported losing more than ₹3.3 crore in an alleged cyberattack that lasted 87 minutes, with funds transferred through 183 unauthorised disbursals to 52 suspected beneficiary accounts.
The Telangana Cyber Security Bureau registered a case after the company’s chief financial officer filed a complaint on October 20. The complainant alleged that unidentified offenders gained unauthorised access to the company’s systems and application programming interface between 10.31 am and 11.58 am on October 19.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
183 Transfers Made in 87 Minutes
According to the complaint, 183 fund disbursals were carried out during the 87-minute period, transferring more than ₹3.3 crore from the company’s bank account to 52 suspected beneficiary accounts without authorisation.
The breach was detected the same day and reported on the National Cyber Crime Reporting Portal. The company also asked police to identify the accused and freeze the beneficiary accounts.
Preliminary investigation indicated that the attackers allegedly carried out a targeted intrusion and rapidly moved the siphoned funds across multiple accounts before the breach was detected.
Police Seek API Logs and Transaction Records
Police said the fraudsters withdrew amounts ranging from ₹50,000 to ₹2 lakh in individual transactions.
Investigators have sought system and API logs, transaction records, bank statements, the company’s internal incident report and other supporting documents as part of the investigation.
The Telangana Cyber Security Bureau has registered a case under Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita, along with Sections 43, 66, 66C and 66D of the Information Technology Act.
Only ₹40 Lakh Blocked So Far
A Telangana Cyber Security Bureau official said only about ₹40 lakh had been blocked in the accounts used by the alleged fraudsters.
Police are analysing the transactions to trace the movement of the remaining funds and identify those involved in the attack.
The investigation is also examining how the attackers gained access to the NBFC’s systems and API and how the unauthorised disbursals were executed in such a short period.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
