Unifinz Capital India has reported a second major cyber fraud incident within three days, involving unauthorized outflows of Rs 7.27 crore. Perpetrators exploited the company's API-integrated disbursal engine to execute 309 fraudulent transactions. The company has suspended the affected system and is pursuing legal action, but the back-to-back breaches raise serious concerns regarding internal IT security and system integrity.
Unifinz Capital Discloses Second Cyber Fraud Incident In Three Days
Financial impact of Rs 7.27 crore reported via 309 unauthorized transactions.
Company suspended its disbursal API following back-to-back security breaches.
Reader Takeaway: Repeated security failures raise material questions regarding system integrity, requiring urgent focus on internal IT controls.
What just happened
Unifinz Capital India Limited reported a second sequential cyber security breach on October 23, 2026. Between 12:01 PM and 2:45 PM, unauthorized third parties manipulated the company's automated API-integrated disbursal engine. By bypassing standard authorization protocols, the attackers directed the bank to process 309 fraudulent transactions, ranging from Rs 99,989 to Rs 2,50,000 each. The total financial exposure from this incident stands at Rs 7.27 crore.
Why this matters
This event is the second major security failure reported by the firm within a 72-hour window, following an initial breach disclosed on October 21, 2026. The recurring nature of these incidents indicates potential systemic vulnerabilities in the company’s payment security architecture. While management claims core operations remain unaffected, the repeated failure to secure the disbursal pipeline poses significant risks to shareholder value and regulatory standing.
Actions taken
Upon identifying the unauthorized activity, Unifinz Capital immediately suspended the affected disbursal API from the bank’s portal. The company has initiated formal complaint procedures with cybercrime and law enforcement authorities to facilitate investigations and potential fund recovery. The ultimate financial impact remains subject to the success of these recovery efforts.
Risks to watch
Investors should monitor the company’s ability to overhaul its IT infrastructure and prevent further breaches. The primary risks involve the potential for additional financial losses, increased regulatory scrutiny, and a likely negative impact on investor sentiment. Governance transparency regarding the investigation and remediation effectiveness is the critical watch point for the coming weeks.