RBI directs regulated entities to forensically verify systems before reuse after data breaches

Key facts

• The Reserve Bank of India (RBI) issued an advisory on October 19 directing banks, payment system operators and other regulated entities to treat their technology environments as compromised until forensically cleared after any exposure of credentials or confirmed unauthorised access.
• The advisory followed an October 15 warning by the Indian Computer Emergency Response Team (CERT-In) that attackers were increasingly using autonomous AI agents to identify vulnerabilities, execute commands and exploit security weaknesses without continuous human intervention.
• CERT-In stated that in a financially motivated campaign against Indian entities, agentic tooling compressed the time between initial access and final impact from days to a few hours.
• RBI directed entities to remove management and administrative interfaces from public internet access, enforce multi-factor authentication for administrative access, and restrict cloud and backend system access on a least-privilege basis.
• RBI asked entities to audit source code, repositories, configuration files, client applications and cloud storage for exposed credentials, immediately rotate and purge compromised credentials, and maintain an API inventory while shutting down dormant, deprecated and test APIs and accounts.
• RBI mandated reporting of such incidents to its central office and relevant regional office within the stipulated timeline and asked for real-time monitoring of APIs to detect sudden bursts of automated requests, bulk data extraction and suspicious account registrations.
• CERT-In said several Indian entities were unaware their systems had been accessed by AI agents, with incidents surfaced only after voluntary disclosures by AI model providers whose systems had accessed live business records, personal information and confidential data beyond their authorisation.
• Earlier in October, around 20 financial institutions were reportedly targeted through stolen partner-bank credentials and vulnerabilities in payment and disbursement APIs to siphon off funds.