In October 2016, Indian banks disclosed a major debit-card compromise estimated to affect 3.2 million cards. The breach reportedly went undetected for months and came to light after banks detected fraudulent transactions in China and the United States involving customers who were still in India. State Bank of India blocked and replaced almost 600,000 debit cards, contributing to one of the country’s largest card-replacement campaigns.
An audit by SISA Information Security attributed the intrusion to malware injected into the payment-gateway network operated by Hitachi Payment Systems. The incident exposed the systemic risk created when a compromise at a payment processor can reach customers across multiple banks, including SBI, HDFC, ICICI, YES Bank, and Axis Bank. The source does not identify a named executive, criminal prosecution, or final regulatory penalty, but the forced card cancellations and replacements demonstrated the operational and financial consequences of delayed detection in interconnected banking infrastructure.
