A major breakthrough has emerged in the ₹11.55-crore cyber fraud that targeted the State Cooperative Bank in Himachal Pradesh. A technical audit by the Cyber Crime Cell, Shimla, has confirmed that the attackers used a Panama-based Virtual Private Network (VPN) to infiltrate the bank’s core banking server and divert funds across multiple states.
Investigators have issued an official notice to the Panama-based VPN provider, seeking detailed logs, timestamps and user information linked to the suspicious IP addresses used during the breach.
The high-profile case has already led to the arrest of seven suspects, including a Nigerian national. The investigation suggests that the entire operation was orchestrated by a cybercriminal known by the alias “KK”, who allegedly executed the server breach and coordinated the multi-state transfer of funds.
Nigerian accused reveals crucial details — 2% commission deal surfaced
The arrested Nigerian suspect, Ben Arinze alias Jonou Maglory Martin, has made significant disclosures during interrogation.
According to Cyber Crime Cell officials, Arinze admitted that KK had approached him prior to the server breach, and he demanded a 2% commission in exchange for facilitating the illegal transactions.
The investigation further revealed that two accomplices — Suresh Babu and Silvester Britto — arranged multiple bank accounts under the names of Dhanshree Souhard Cooperative Ltd. and Extreem, which were later handed over to another accused, Shavaz Pasha.
Pasha subsequently forwarded the accounts to Arinze, who was living in Channasandra, Whitefield (Bengaluru) at the time.
Based on these leads, investigators tracked Arinze’s digital footprint and arrested him on 17 August 2025.
Officials stated that Arinze acted as a key conduit in the network — linking the mastermind, the hacker, and the individuals responsible for arranging bank accounts used to siphon funds.
Algoritha Prepares You for Seamless DPDP Compliance — Contact Us for Complete Implementation Support
How the ₹11.55-crore cyber attack unfolded
The cyber heist took place on 16 May 2025, when attackers gained unauthorized remote access to the State Cooperative Bank’s core banking server.
Once inside the system, the hackers rapidly transferred ₹11,55,56,417 to bank accounts spread across Mumbai, Jaipur, Uttar Pradesh, Rajasthan, Karnataka, and several other locations.
The bank management immediately alerted local police and subsequently escalated the matter to the Cyber Crime Cell.
As the money trail expanded, investigators made arrests from Maharashtra, Uttar Pradesh, Rajasthan, and even traced links to Nigeria.
Suspicious high-value transactions in multiple accounts helped authorities identify the network of mule accounts used to launder the stolen funds.
₹2.5 crore recovered so far — extensive money trail inquiry underway
In a significant achievement, the Cyber Crime Cell has successfully recovered ₹2.5 crore out of the siphoned amount.
The team is now expanding its investigation across Karnataka and several other states to trace remaining fund movements.
Officials are also examining whether the hackers used additional digital tools — including proxy servers, forged documents, shell entities and multiple mule accounts — to mask their activities and avoid detection.
Forensic experts are analyzing digital devices recovered from the accused to uncover communication logs, hidden data, encrypted files, and financial trails.
What happens next? Key investigative steps
- Demand for detailed VPN usage logs from the Panama-based service provider, including IP trails and session metadata
- Advanced forensic examination of seized laptops, mobile phones and network devices
- Tracing international links, particularly the origin of the hack and KK’s identity
- Coordinated action with police forces in other states to freeze additional accounts and apprehend more suspects
Cyber officials describe this as one of the most sophisticated and layered cyber frauds uncovered in Himachal Pradesh, adding that the case is expected to reveal more foreign links and financial nodes in the coming weeks.
