{"id":10144,"date":"2026-07-06T14:10:03","date_gmt":"2026-07-06T18:10:03","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10144"},"modified":"2026-07-06T13:50:31","modified_gmt":"2026-07-06T17:50:31","slug":"indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/","title":{"rendered":"India&#8217;s bank domain registry left admin data exposed for over a year"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\">The domain meant to make Indian banks harder to fake spent more than a year with its own back door wide open.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">In 2025, the <a href=\"https:\/\/www.rbi.org.in\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Reserve Bank of India<\/a> rolled out .bank.in, a restricted web suffix only verified banks could use, aimed at cutting down on phishing sites that mimic real banking portals. The idea was simple: if customers see .bank.in in the address bar, they can trust it. But the registry running that system, IDRBT, apparently wasn&#8217;t holding up its end.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Researcher Srikanth L of CashlessConsumer found that IDRBT&#8217;s portal exposed sensitive data belonging to all 5,576 employees who manage bank domains under the .bank.in system, according to a report later covered by The Register. The culprit was more than 33 API endpoints that required no authentication at all, so anyone who found the right URL could pull the data directly.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The open data included bcrypt-hashed passwords, email addresses, phone numbers, login IP addresses, and device fingerprints. The report also flagged over 1,000 orphaned super-admin accounts still sitting active in the system. The hashed passwords at least bought some protection. Anyone could read everything else as is.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">No evidence confirms that anyone besides the researcher accessed the data during the roughly 13 months it sat exposed. But that&#8217;s arguably beside the point. These weren&#8217;t customer records. They were credentials belonging to the people who control which bank domains exist and where they lead.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Phishing or credential theft targeting them could have handed an attacker control over a domain the whole system aimed to protect.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The report also raises questions about how developers built the portal in the first place. <a href=\"https:\/\/www.ikcontech.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">IKCON Technologies<\/a> won the contract without any competitive bidding, despite IDRBT&#8217;s own policy claiming the site had passed a vulnerability audit before launch.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The fix, once someone finally looked, took about two weeks. IDRBT received notice from CERT-In on June 8, 2026, and patched the issue by June 25. Neither IDRBT nor the RBI has commented publicly.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The .bank.in system still does what its designers intended. This incident just makes clear that a trust badge only holds up as well as the registry issuing it, and unauthenticated APIs remain a wide open door.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The domain meant to make Indian banks harder to fake spent more than a year with its own back door wide open. In 2025, the Reserve Bank of India rolled out .bank.in, a restricted web suffix only verified banks could use, aimed at cutting down on phishing sites that mimic real banking portals. The idea [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7262,7264,7263,7265,7266],"class_list":["post-10144","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-bank-in-security-breach","tag-banking-domain-fraud","tag-idrbt-data-exposure","tag-indian-banking-cybersecurity","tag-unauthenticated-api-vulnerability"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>India&#039;s bank domain registry left admin data exposed for over a year - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"India&#039;s bank domain registry left admin data exposed for over a year - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"The domain meant to make Indian banks harder to fake spent more than a year with its own back door wide open. In 2025, the Reserve Bank of India rolled out .bank.in, a restricted web suffix only verified banks could use, aimed at cutting down on phishing sites that mimic real banking portals. The idea [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-06T18:10:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-06T17:50:31+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/\",\"name\":\"India's bank domain registry left admin data exposed for over a year - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-07-06T18:10:03+00:00\",\"dateModified\":\"2026-07-06T17:50:31+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"India&#8217;s bank domain registry left admin data exposed for over a year\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"India's bank domain registry left admin data exposed for over a year - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/","og_locale":"en_US","og_type":"article","og_title":"India's bank domain registry left admin data exposed for over a year - Web Hosting News","og_description":"The domain meant to make Indian banks harder to fake spent more than a year with its own back door wide open. In 2025, the Reserve Bank of India rolled out .bank.in, a restricted web suffix only verified banks could use, aimed at cutting down on phishing sites that mimic real banking portals. The idea [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/","og_site_name":"Web Hosting News","article_published_time":"2026-07-06T18:10:03+00:00","article_modified_time":"2026-07-06T17:50:31+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/","url":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/","name":"India's bank domain registry left admin data exposed for over a year - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-07-06T18:10:03+00:00","dateModified":"2026-07-06T17:50:31+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/indias-bank-domain-registry-left-admin-data-exposed-for-over-a-year\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"India&#8217;s bank domain registry left admin data exposed for over a year"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":127,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10144"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10144\/revisions"}],"predecessor-version":[{"id":10145,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10144\/revisions\/10145"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}