RBI fines Mahesh Co-operative Bank Rs 65 lakh for failing to adopt cyber security norms

HYDERABAD: Thanks to the efforts of the Hyderabad City Police Cyber Crime Wing the Reserve Bank of India (RBI) imposed a penalty of Rs 65 lakh on AP Mahesh Co-operative Urban Bank Ltd., Hyderabad for blatant non-compliance with the provisions of the cyber security framework for primary urban cooperative banks.

A sophisticated hacker breached the bank's systems and siphoned off Rs 12.48 crore on on January 24, 2022. The criminal act was carried out through a series of phishing emails that were cleverly disguised and sent to bank employees. Upon opening these malicious emails, the employees' systems were compromised, providing the fraudsters full access to the bank's network.

A case was registered and after enormous efforts by multiple police teams, several perpetrators, including Nigerian nationals, were arrested. This investigation also revealed the bank's negligence which is evident from its failure to implement Cyber security measures, such as anti-phishing applications, intrusion prevention and detection systems, and real-time threat defense and management systems, as mandated by the RBI.

These cyber security components indispensable for safeguarding the cyber landscape, were found to be conspicuously absent within the bank's cyber security infrastructure. Hyderabad City Police Commissioner, CV Anand, corresponded with the RBI Governor, highlighting the critical lapses and requesting suspension of the bank's license to operate.

As the current legal framework did not allow for criminal negligence charges against the bank management, the city police pursued the matter, which resulted in the RBI imposing a monetary penalty on the bank.