More than 32 lakh debit cards of customers have been blocked or recalled by banks to prevent them from falling prey to any financial fraud after a major security breach at a payment services provider that manages ATM network of a private sector bank. While some of the banks like SBI have re-called around six lakh cards, others like Bank of Baroda, IDBI Bank, Central Bank and Andhra Bank have already replaced their debit cards which are effected as a pre-emptive measure.
Some of the lenders like ICICI Bank, HDFC Bank and Yes Bank have asked customers to change their ATM pin numbers. HDFC Bank also advised its customers to use its own ATMs for carrying out any transaction. The suspected security breach happened through a malware in the systems of Hitachi Payments Services, which serves Yes Bank. Hitachi provides payment services through ATM services, point of sale services (POS), emerging payments services and banking channel products like cash recycling ATMs and auto passbook entry machines.
“Necessary corrective actions already have been taken and hence there is no reason for bank customers to panic. Advisory issued by NPCI to banks for re-cardification is more as a preventive exercise,” said A. P Hota, MD & CEO, NPCI.
State Bank of India in a statement said, "Card network companies NPCI, MasterCard and Visa had informed various banks about a potential risk to some cards owing to a data breach. Accordingly, we have taken precautionary measures and have blocked cards of certain customers identified by the networks." SBI deputy MD and COO Manju Agarwal explained that the data breach took place between May and July, but was discovered only in September and so the bank decided to proactively change the cards.
Mastercard says its own systems have not been breached
Amid fears of security breach of as many as 3.25 million debit cards, Mastercard yesterday said its own systems have not been breached. "We are aware of the data compromise event. To be clear, Mastercard's own systems have not been breached," a Mastercard spokesperson said in an email statement.