Hitachi owns up: Systems compromised in 2016 leading to scare
In a final closure to the compromise of 3.2 million debit cards in the month of October of 2016, the audit report has confirmed that the malware that compromised the cards had infected the Hitachi ATM payments network. The story was first broken by Economic Times on October 20 of last year and reports then had indicated that the malware had originated in the ATM network, but National Payments Corporation of India, had appointed SISA to conduct the audit and confirm.
In a statement to the media, Hitachi Payment Services confirmed the breach and said that they will continue to undertake all mandatory and regulatory security measures to enhance the security of their systems.
"We confirm that our security systems had a breach during mid-2016. As soon as the breach was discovered, we followed due process and immediately informed the Reserve Bank of India (RBI), National Payments Corporation of India (NPCI), banks and card schemes to ensure the safety of their customers’ sensitive data," said loney Antony, managing director, Hitachi Payment Services.
The report also confirmed that the malware, had been able to work undetected and had concealed its tracks during the compromise period. While the behaviour of the malware and the penetration into the network has been deciphered, the amount of data compromised during the above period is unascertainable due to secure deletion by the malware, said the report.
Bankers say that the malware was so advanced that it could self destruct after the target was accomplished thereby not leaving behind much of trace to be tracked back to its originator. It was one of the biggest cyber attacks on the debit card network in the history of the Indian banking system.
Of the cards, 2.6 million were said to be on the Visa and Master-Card platform and 600,000 on the RuPay platform and the worst hit were ICICI Bank, Yes Bank, Axis Bank, HDFC Bank and State Bank of India. SBI even went further to cancel some 6 lakh debit cards and issued them afresh to customers.
The attacks was left undetected for a very long time until people started complaining to their banks about cards being used in far off countries like China, Brazil and others when banks and other players woke up to the event and discovered the attack.
In a statement to the media, Hitachi Payment Services confirmed the breach and said that they will continue to undertake all mandatory and regulatory security measures to enhance the security of their systems.
"We confirm that our security systems had a breach during mid-2016. As soon as the breach was discovered, we followed due process and immediately informed the Reserve Bank of India (RBI), National Payments Corporation of India (NPCI), banks and card schemes to ensure the safety of their customers’ sensitive data," said loney Antony, managing director, Hitachi Payment Services.
The report also confirmed that the malware, had been able to work undetected and had concealed its tracks during the compromise period. While the behaviour of the malware and the penetration into the network has been deciphered, the amount of data compromised during the above period is unascertainable due to secure deletion by the malware, said the report.
Bankers say that the malware was so advanced that it could self destruct after the target was accomplished thereby not leaving behind much of trace to be tracked back to its originator. It was one of the biggest cyber attacks on the debit card network in the history of the Indian banking system.
Of the cards, 2.6 million were said to be on the Visa and Master-Card platform and 600,000 on the RuPay platform and the worst hit were ICICI Bank, Yes Bank, Axis Bank, HDFC Bank and State Bank of India. SBI even went further to cancel some 6 lakh debit cards and issued them afresh to customers.
The attacks was left undetected for a very long time until people started complaining to their banks about cards being used in far off countries like China, Brazil and others when banks and other players woke up to the event and discovered the attack.
