Ransomware attack: Payment systems suspended in India's 300 banks

A major ransomware attack on Indian banking and finance software company C-Edge Technologies, has forced a temporary shutdown of nearly 300 small and rural cooperative banks' payment systems.

The National Payments Corporation of India (NPCI) announced via its X (formerly Twitter) handle post last evening that C-Edge Technologies, which primarily supports cooperative and regional rural banks, has been targeted by a ransomware attack.

C-Edge, a joint venture between state-owned State Bank of India and private Tata Consultancy Services, serves cooperative banks and regional rural banks which have been hit by the cyber security attack.

Other banking services remained unaffected, officials stated.

To protect the broader payments system, necessary precautions, including isolating the C-Edge system, had to be implemented following the breach noticed two days ago.

An industry official told PTI that a ransomware had been detected and isolated within the system, prompting a third-party audit.

The official said the affected banks represent less than one percent of the total payment system volume in the country.

To guard against further risks to the payment infrastructure, NPCI has temporarily cut off C-Edge Technologies from its retail payment networks. As a result, customers of banks relying on C-Edge's services are currently unable to access payment systems.

NPCI said in a statement that "C-Edge Technologies … has been possibly impacted by a ransomware attack impacting a few of their systems," leading to the temporary isolation of C-Edge from accessing NPCI-operated retail payment systems. All online transactions, such as RTGS and UPI payments, are affected."

Dileep Sanghani, chairman of the national cooperative union of India, told PTI that nearly 300 banks which rely on C-Edge, have been facing issues for the past two to three days.

"All online transactions, such as RTGS and UPI payments, are affected. Money is deducted from the sender's account but does not get credited in the receiver's account," Sanghani said.