RBI Tightens Data Breach Rules For Banks, Payment Firms Amid Cyberattack Concerns

The Reserve Bank of India (RBI) has asked banks, payment system operators and other regulated entities to tighten cybersecurity controls following a series of cyberattacks and data-security incidents involving financial institutions.

The RBI issued the advisory on October 19, 2026, asking regulated entities to treat their technology environment as compromised if credentials are exposed or unauthorised access is confirmed. The affected systems should remain under that assumption until they are cleared through a forensic investigation.

The advisory follows warnings from the Indian Computer Emergency Response Team (CERT-In) over cyberattacks targeting NBFCs, fintech companies, payment service providers and other financial entities. CERT-In had flagged the use of stolen credentials, exposed payment APIs and weaknesses in internet-facing systems in attacks involving unauthorised fund transfers.

The RBI action also comes as State Bank of India (SBI) investigates suspected exposure of customer information after records surfaced on the dark web. SBI was alerted about the incident on October 16 and disclosed it on October 21. The bank’s preliminary analysis of around 3.75 lakh records identified 3,897 customer records containing personally identifiable information.

There is no indication that the SBI incident alone prompted the RBI advisory. The central bank’s directions follow broader cybersecurity warnings affecting financial institutions and cover banks, payment firms and their technology service providers.

RBI Data Breach Rules

The RBI has asked financial institutions to tighten access to critical technology systems and reduce the number of points through which attackers can enter or remain inside their networks.

Management and administrative interfaces should not remain accessible through the public internet, while multi-factor authentication has been sought for administrative access.

Banks and payment firms have also been asked to review source code, repositories, configuration files, client applications and cloud storage for exposed credentials. Credentials found to have been compromised should be changed and removed from exposed locations.

Cloud and backend systems are also part of the advisory. Access to these systems should be restricted based on operational requirements.

The RBI has separately tightened its focus on APIs, which are widely used by banks, fintech companies and payment firms to connect different technology systems and process transactions.

Regulated entities have been asked to maintain an inventory of their APIs and shut down dormant, deprecated and test APIs and accounts that are no longer required.

They have also been asked to monitor API activity in real time for unusual patterns. These include sudden bursts of automated requests, bulk extraction of data and suspicious account registrations.

The directions extend to third-party technology providers. Banks and payment firms have been asked to ensure that appropriate cybersecurity controls are followed by service providers that have access to their systems or data.

Cybersecurity incidents are also required to be reported to the RBI’s central office and the relevant regional office within the prescribed timeline.

Cyberattacks On Financial Firms Put APIs And Credentials Under Watch

The RBI advisory comes after CERT-In and CSIRT-Fin warned on October 9 about cyberattack campaigns targeting India’s financial sector.

The warning covered NBFCs, digital lending platforms, fintech companies, payment service providers and wallet operators.

CERT-In said attackers were targeting internet-facing applications and exposed APIs while also stealing credentials associated with payment aggregators, payment gateways and partner banks.

In some incidents, stolen credentials were used to access fund-transfer and disbursement APIs. The attacks involved unauthorised movement of money to mule accounts.

The cybersecurity agency also flagged risks involving old or unused APIs, credentials stored in plain text, static API tokens embedded in source code and remote services without adequate authentication.

A second CERT-In advisory on October 15 highlighted the growing use of artificial intelligence tools in cyberattacks.

CERT-In said AI-based tools were being used for activities including reconnaissance and exploitation. In financially motivated attacks against Indian entities, the time between gaining initial access and the eventual impact had reduced from days to a few hours.

The agency also found cases where organisations that had not completely addressed identified vulnerabilities were attacked again within days.

The RBI advisory issued four days later focuses on several of the same areas, including credentials, administrative access, APIs, cloud systems and continuous monitoring of suspicious activity.

SBI Investigates Suspected Customer Data Exposure

The RBI directions come at a time when India’s largest lender, SBI, is investigating a suspected customer-data exposure.

SBI said it was alerted on October 16 by its threat-intelligence service provider, the Defence Cyber Agency and CERT-In about suspected customer information available on the dark web.

The bank subsequently examined around 3.75 lakh records and identified 3,897 customer records containing personally identifiable information.

The information included names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch and Customer Information File identifiers, lead IDs and metadata linked to loan and lead records.

SBI activated its cyber-incident response and containment protocols and appointed an independent CERT-In-empanelled cybersecurity agency to investigate the matter.

The bank said a detailed investigation was required to establish the authenticity and completeness of the information, its possible source and the extent of the exposure.

SBI also said the incident had not materially affected its IT systems, core business operations, financial performance or business continuity.

The source of the suspected exposure has not yet been established. SBI’s investigation and the RBI’s latest directions are now being closely watched as banks and payment companies strengthen controls around customer data, APIs and access to critical technology systems.

Also Read - IDBI Bank-Fairfax Deal: Government, LIC To Cap Stakes At 15%; Open Offer To Follow