Andhra Pradesh Mahesh Co-Operative Urban Bank

Profile narrative

Andhra Pradesh Mahesh Co-Operative Urban Bank, also known as APMCUB, is a cooperative urban bank headquartered in India. It provides core banking services such as savings and current accounts, loans, and ATM facilities to its member customers. As a cooperative institution, the bank is owned and governed by its members rather than external shareholders. Its primary market consists of individuals and small businesses in the Andhra Pradesh region, reflecting its focus on local community banking. The bank operates within the broader cooperative banking sector, which emphasizes mutual assistance and member‑driven financial services. Being an urban cooperative bank, it is positioned to serve the financial needs of urban and semi‑urban populations while adhering to cooperative principles.

In early 2022, the bank suffered a cyberattack in which phishing emails delivered a Remote Access Trojan to employees, exploiting missing firewall licensing, lack of intrusion detection/prevention systems, absent phishing protections, no VLAN segmentation, and insufficient staff training. The compromise allowed attackers to access core banking servers, inflate balances in four accounts by millions of rupees, and transfer funds to 115 accounts across India. Subsequent withdrawals exceeded $1 million from 938 ATMs nationwide, while authorities froze approximately $2 million of additional funds. Investigations linked the attack to suspects from Nigeria and the United Kingdom who used proxy IPs and VPNs to conceal their locations, with several arrests made among Nigerian nationals and local accomplices. A similar incident in November 2021 involved a phishing‑borne Remote Access Trojan, fraudulent account creation, and ATM cash withdrawals, again highlighting missing basic security controls and inadequate employee cybersecurity training. These breaches underscored systemic security deficiencies, including the absence of valid firewall licensing, intrusion detection/prevention, phishing safeguards, network segmentation, and proper staff awareness programs. The bank remains a member‑owned cooperative urban bank without any disclosed parent or subsidiary relationships.

Incidents

2 incidents linked to this organisation.