India’s .bank.in registry leaked data of 5,576 bank staff

In 2025, India’s central bank mandated that all local banks adopt a .bank.in domain to reduce phishing risks. The Institute for Development and Research in Banking Technology (IDRBT) was appointed as the sole registrar for the namespace. However, the system designed to enhance trust in banking infrastructure instead became a security liability when its registration portal exposed sensitive data for over a year.

What was exposed

A security researcher, identified as Srikanth L, reported that the IDRBT Domain Registration Portal (registrar.idrbt.ac.in) left 33 REST API endpoints unauthenticated. These endpoints allowed anyone with basic tools like curl to retrieve bcrypt password hashes, mobile numbers, email addresses, login IP addresses, and device fingerprints of all 5,576 bank employees authorized to manage .bank.in domains. The researcher also discovered that some Indian banks host their websites on shared servers located in the United States, Singapore, and Lithuania, raising concerns about data sovereignty and infrastructure resilience.

The researcher published findings on a GitHub repository, making some of the exposed data publicly accessible. While the intent was to aid security research, the disclosure also highlighted the risk that malicious actors could have exploited the same data for phishing, DNS spoofing, or other attacks. Many of the exposed domains relied on free Let’s Encrypt certificates, which, while secure, may not meet the higher assurance standards expected for financial institutions.

Response and implications

Srikanth L disclosed the vulnerability to IDRBT in early June 2026, and the organization subsequently secured the API endpoints. However, as of 30 June 2026, neither IDRBT, the Reserve Bank of India, nor the Indian government had issued a public statement addressing the incident. The lack of transparency leaves unanswered questions about whether the exposed data was accessed by unauthorized parties during the 13-month window.

The incident undermines the original goal of the .bank.in mandate: to create a trusted, phishing-resistant namespace for Indian banks. Instead, the registry’s poor security practices introduced new risks, including the potential for attackers to impersonate bank employees or manipulate DNS records. The fact that 80% of registered domains lacked DNSSEC and 40% did not use DMARC further weakens the security posture of India’s banking sector, despite the central bank’s efforts to standardize protections.

What to watch

The incident raises broader questions about the oversight of specialized TLD registries, particularly those handling sensitive sectors like finance. If IDRBT’s portal lacked basic security controls, similar vulnerabilities may exist in other country-code or industry-specific registries. Regulators and industry groups may push for stricter security standards for registries, including mandatory audits and breach disclosure requirements. Meanwhile, Indian banks will need to assess whether the exposed credentials were compromised and take steps to rotate them, even if no evidence of misuse has emerged.