Cosmos Bank Hit by ₹94.42 Crore Cyber Heist in Coordinated Global Attack Pune-based Cosmos Bank, one of India’s oldest urban cooperative banks, fell victim to a sophisticated cyberattack on August 11 and 13, resulting in the theft of ₹94.42 crore ($13.5 million). The breach occurred just days after the FBI issued a warning about a planned global "ATM cash-out" fraud targeting financial institutions. The attack began on August 11, when hackers compromised the bank’s ATM switch server via malware, stealing data linked to VISA and RuPay debit cards. Over 14,849 fraudulent transactions were executed, siphoning ₹80.50 crore ₹78 crore through 12,000 VISA transactions abroad and ₹2.5 crore via 2,849 RuPay transactions within India. The withdrawals, made using cloned cards, ranged from $100 to $11,000 and spanned 28 countries, with the highest single transaction recorded at ₹7.59 lakh. On August 13, the attackers struck again, exploiting the bank’s SWIFT system to transfer ₹13.92 crore to ALM Trading Limited, an account in a Hong Kong-based bank. Cosmos Bank’s managing director, Suhas Gokhale, filed a complaint with Pune’s Chatushrungi police, who registered a case under the IT Act and other penal provisions. Bank officials detected the fraud after VISA flagged suspicious transactions at 5 PM on August 11, prompting the bank to disable VISA and RuPay ATM services. A subsequent server inspection on August 12 confirmed the breach, while a second review on August 13 uncovered the SWIFT-based theft. The bank shut down its servers and internet banking to contain the damage. Cosmos Bank chairman Milind Kale assured customers that depositor funds remained secure, emphasizing that the bank’s security systems were not compromised. The Reserve Bank of India (RBI) had inspected the bank’s IT infrastructure in July, and four RBI officials were later deployed to assess the breach. While cybersecurity experts suspected the involvement of international hacking groups like North Korea’s Lazarus, the bank traced the attack’s origin to Canada, though police refrained from naming a specific culprit. The bank’s ability to recover the stolen funds remains uncertain, with Kale stating that reconciliation with VISA and RuPay would take 2–7 days, while international recovery efforts would depend on cross-border coordination. The full extent of the financial loss will only be determined after further investigations.