Indusind Bank Ltd

Cyber Security Incident Involving Bank Vendor – Qapita EquityTech Limited On 29 October 2025, a ransomware security incident was detected by our vendor Qapita EquityTech Limited (operating ESOP Direct, formerly known as KP Corporate Solutions Limited). Our organization is a tenant on Qapita’s hosted infrastructure. The incident did not originate from the bank’s internal network, systems, or user endpoints. Based on the root cause analysis and forensic investigation shared by the vendor, the compromise originated within Qapita’s infrastructure at their Pune office. The threat actor is reported to have gained dormant access to the vendor environment on 23 May 2025, with the active compromise, including unauthorized data access and ransomware encryption, occurring on 29 October 2025 at approximately 01:05 UTC. The vendor has confirmed that the incident was reported to CERT-In within six hours of detection. Further interim updates were submitted to CERT-In under reference number CERT-In/81288825 after additional threat actor activities were identified in January 2026 and February 2026. Although the initial unauthorized access occurred in October 2025, data related to our organization was published by the threat actor on 08 February 2026. In line with regulatory compliance requirements, the bank has reported this incident on the Daksh portal as part of its mandatory regulatory and supervisory reporting obligations. Following the incident, Qapita implemented immediate corrective measures, including remediation of the identified vulnerability and strengthening of its overall security controls. As per the latest compromise assessment report shared by the vendor, no active threats have been detected.

Defacement of the Website “indusind.bank.in”; Ref:CERTIn-D26030245 As per CERT‑In advisory Ref: CERTIn‑D26030245, a website defacement incident was reported involving the Bank’s public domain indusind.bank.in. The alert indicated the presence of an unauthorized file (cron.txt) within the Adobe media directory on the application server, suggesting a potential exploitation of a known Adobe configuration vulnerability. The affected URL identified during the alert was: hxxps://induseasywheels[.]indusind[.]bank[.]in/media/customer_address/c/r/cron.txt An investigation was initiated immediately upon receipt of the alert. Analysis confirmed that the issue was caused by a known vulnerability in the Adobe application setup, which could allow unintended access to the media directory if the prescribed configuration‑level security patch was not applied. The Bank engaged with Adobe support, who confirmed that a security mitigation in the form of a Varnish Configuration Language (VCL) patch had been released earlier to address this vulnerability. The recommended configuration patch was applied, post which validation testing was conducted. Attempts to access the previously exposed path returned HTTP 404 (Not Found) responses, confirming successful remediation. No further unauthorized file placement or abnormal activity was observed after the fix. As per vendor, the incident was contained, and no impact on the Bank’s internal systems, customer data, or core banking applications was identified.