3.2 Million debit cards hacked by a malware in One of India's Largest Data Breaches! Beware!

India has been affected by one of the worst cyber attack in the nation’s history. The Economic Times (ET) has reported that around 3.2 million debit cards of Indian citizens have been compromised. These cards are mainly issued by State Bank of India (SBI), Axis Bank, ICICI Bank, Yes Bank and HDFC Bank.

Out of the 3.2 million, 2.6 million cards belong to VISA and MasterCard platforms. The rest 600,000 cards are on RuPay, a domestic card scheme launched by the National Payments Corporation of India.

According to the report,security breach has emerged due to a malware present in the Hitachi Payment Services’ systems. Hitachi Payments Services, which provides ATM and PoS services in India, has been hit by one of the biggest financial data breaches in the country. The reported malware that was injected into their system enabled the attackers to steal confidential information.

“We have received complaints from banks about debit cards being used in China which aroused suspicion,” said AP Hota, Managing Director NPCI.

“Though most of the suspected fraudulent transactions happened in the Visa and MasterCard network, we thought a whole a forensic audit of the entire network will help us find out where the compromise happened.”

The fact that MasterCard and VISA are more affected than RuPay might be a consequence of the higher popularity and reach of the former two.

HDFC, one of the affected banks, has updated its customers with security measures. The users have been advised to change their PIN regularly and refrain themselves from using non-HDFC ATMs.

SBI, another affected bank, is doubting the security aspects of non-SBI ATM service providers based on user complaints. The bank has blocked 600,000 cards as a precautionary measure.SBI is even rolling out new ATM cards with a chip integrated on them which would make it impossible to breach such cards in the future.

A payment security specialist firm SISA has been appointed for the forensic investigation of the security breach. ET, claiming sources, has reported that it took around six weeks to detect the malware infection.