An RBI advisory dated October 19 tells banks, payment system operators and other regulated entities to treat their technology environments as compromised until forensically cleared after any credential exposure or confirmed unauthorised access, The Economic Times reported. Firms must take administrative interfaces off the public internet, enforce multi-factor authentication, rotate exposed credentials, shut dormant and test APIs, and monitor APIs for bursts of automated requests and bulk data extraction, including at third-party providers.
Why it matters: The advisory follows CERT-In’s October 15 warning that in a campaign against Indian entities, AI agents cut the time from first access to final impact from days to a few hours, and that some victims learned of the access only from AI model providers. Assuming breach puts the burden of proof on banks, payment firms and their vendors, after ET reported this month that about 20 financial institutions had been targeted through stolen partner-bank credentials and weak payment and disbursement APIs.
Source: The Economic Times, October 23, 2026; Business Standard, October 15, 2026
Image: BalticServers.com, CC BY-SA 3.0, via Wikimedia Commons
