Hyderabad, October 23, 2026 | GAWAH News Desk
A Hyderabad-based non-banking financial company (NBFC) has reported that more than ₹3.3 crore was transferred out of its account through 183 unauthorised transactions over an 87-minute period, according to media reports citing the complaint filed with the Telangana Cyber Security Bureau (TGCSB).
The alleged transfers took place between 10:31 am and 11:58 am on October 19. The money was reportedly sent to 52 suspected beneficiary accounts. The company’s chief financial officer filed a complaint with the TGCSB on October 20, and investigators are examining the incident.
What happened in the 87-minute window?
According to the complaint as reported by Siasat and The Times of India, unidentified individuals allegedly accessed the company’s systems and application programming interface (API) without authorisation. The 183 transfers reportedly moved more than ₹3.3 crore to the suspected beneficiary accounts.
The company detected the breach on October 19 and reported it through the National Cyber Crime Reporting Portal. The precise method used to gain access has not been established publicly, and the investigation is continuing.
Only ₹40 lakh reportedly blocked
A TGCSB official quoted in media reports said approximately ₹40 lakh had been blocked in suspected beneficiary accounts. That is a preliminary figure: funds being blocked is not the same as money being finally recovered, and the eventual recovery amount has not been confirmed.
Investigators are reportedly analysing transaction records and seeking system and API logs, bank statements and the company’s internal incident report to trace the movement of funds and identify those responsible. No individual should be treated as guilty unless established through due process.
Why API security matters
An API is a way for software systems to communicate and exchange data or instructions. Financial businesses may use APIs to connect digital services and transaction systems. If an attacker gains unauthorised access to a system that can initiate transactions, the consequences can escalate quickly.
The public reporting does not establish whether this incident involved stolen credentials, a software vulnerability, inadequate transaction controls or another route. It would be premature to claim a specific security failure before investigators establish how the breach occurred.
For organisations handling payments, the case is a reminder to review privileged access, multi-factor authentication, API credentials, transaction limits, real-time anomaly alerts and procedures for rapidly suspending suspicious transfers. These are general security recommendations, not confirmed findings about the company’s controls.
What to do if you discover cyber fraud
Anyone who discovers an unauthorised financial transaction should contact their bank or payment provider immediately, preserve transaction messages and reference numbers, and report the incident promptly through India’s cybercrime helpline at 1930 and the National Cyber Crime Reporting Portal. Quick reporting may help authorities attempt to trace or freeze funds, but recovery is not guaranteed.
Key questions remain
The investigation must establish how the alleged access was obtained, where the transferred funds went, who controlled the beneficiary accounts and how much money can ultimately be recovered. The reported ₹3.3-crore figure comes from the complaint as described in media reports; the technical cause and final recovery position remain unconfirmed.
GAWAH will update this report if the Telangana Cyber Security Bureau or the company provides further verified information.
Sources: Siasat; The Times of India; National Cyber Crime Reporting Portal.
