Lok Sabha Question No. 508 (UNSTARRED), answered on 2016-11-18
Subject: Data Breach in Banks
Ministry: FINANCE
Asked by: P. C. MOHAN, BHOLA SINGH, JITENDRA CHAUDHURY, DINESH TRIVEDI, JOSE K. MANI, NITYANAND RAI, Y. S. AVINASH REDDY, PRALHAD VENKATESH JOSHI, SHIVAJI ADHALRAO PATIL, SURESH KODIKUNNIL, ANURAG SINGH THAKUR, K. C. VENUGOPAL, DUSHYANT CHAUTALA, NANABHAU FALGUNRAO PATOLE, DHARMENDRA YADAV, PREM SINGH CHANDUMAJRA, VINAYAK BHAURAO RAUT, GOPALAKRISHNAN CHINNARAJ, RAVINDRA VISHWANATH GAIKWAD, RAMACHANDRAN MULLAPPALLY, LALLU SINGH, P.K.SREEMATHI TEACHER, FEROZE VARUN GANDHI, SHRIKANT EKNATH SHINDE, KAUSHALENDRA KUMAR, JANARDAN SINGH SIGRIWAL, RAM KUMAR SHARMA KUSHWAHA, BIRENDRA KUMAR CHOUDHARY, M. CHANDRAKASI, T.G. VENKATESH BABU, BALASUBRAMANIAM SENGUTTUVAN, SUKENDER REDDY GUTHA, SUNIL KUMAR SINGH, M. B. RAJESH, JAYADEV GALLA, R. GOPALAKRISHNAN

GOVERNMENT OF INDIA MINISTRY OF FINANCE DEPARTMENT OF FINANCIAL SERVICES

## LOK SABHA UNSTARRED QUESTION NO.508

TO BE ANSWERED ON THE 18 th  November, 2016/ Kartika 27, 1938 (SAKA)

## Data Breach in Banks QUESTION

508. SHRI P.C. MOHAN: DR. BHOLA SINGH: SHRI JITENDRA CHAUDHURY: SHRI DINESH TRIVEDI: SHRI JOSE K. MANI: SHRI NITYANAND RAI: SHRI Y.S. AVINASH REDDY: SHRI PRALHAD JOSHI: SHRI ADHALRAO PATIL SHIVAJIRAO: SHRI KODIKUNNIL SURESH: SHRI ANURAG SINGH THAKUR: SHRI K.C. VENUGOPAL: SHRI DUSHYANT CHAUTALA: SHRI NANA PATOLE: SHRI DHARMENDRA YADAV: PROF. PREM SINGH CHANDUMAJRA: SHRI VINAYAK BHAURAO RAUT: DR.C.GOPALAKRISHNAN: PROF. RAVINDRA VISHWANATH GAIKWAD: SHRI MULLAPPALLY RAMACHANDRAN: SHRI LALLU SINGH: SHRIMATI P.K. SREEMATHI TEACHER: SHRI FEROZE VARUN GANDHI: DR. SHRIKANT EKNATH SHINDE: SHRI KAUSHALENDRA KUMAR: SHRI JANARDAN SINGH SIGRIWAL: SHRI RAM KUMAR SHARMA: SHRI BIRENDRA KUMAR CHOUDHARY: SHRI M.CHANDRAKASI: SHRI VENKATESH BABU T.G.: SHRI B. SENGUTTUVAN: SHRI GUTHA SUKENDER REDDY: SHRI SUNIL KUMAR SINGH: SHRI M.B. RAJESH: SHRI JAYADEV GALLA: SHRI R. GOPALAKRISHNAN:

Will the Minister of FINANCE be pleased to state:

- (a) whether the Indian banking sector has recently experienced the worst reported data breach/cyber attack of its system;
- (b) if  so,  the  details  thereof  along  with  the  number  of  customers  affected  and  amount involved therein, bank and State/UT-wise;
- (c) whether  the  Government  has  conducted  any  inquiry  in  this  regard  and  if  so,  the details thereof and the outcome therefrom;
- (d) whether  the  Government  has  any  proposal  to  establish  a  dedicated  monitoring system and setting up a cyber security research and development fund and if so, the details thereof; and
- (e)       the other remedial steps taken/being taken by the Government/National Payments Corporation of India (NPCI) to check such incidents in future?

## ANSWER

The Minister of State in the Ministry of Finance (SHRI SANTOSH KUMAR GANGWAR)

(a) to (e):  Reserve Bank of India (RBI) has informed that an incident of data breach with respect to cards was  reported and  the matter is under investigation.  Independent investigation  by  a  forensic  auditor  approved  under   Payment  Card  Industry  Data  Security Standard (PCI-DSS) framework is under process.

RBI has  set up a Cyber Security and IT Examination (CSITE) Cell within its Department of  Banking  Supervision  in  2015.  The  Bank  issued  a  comprehensive  circular  on  Cyber Security Framework in Banks on June 2, 2016 covering best practices pertaining to various aspects of cyber security. The circular requires banks to have among other things, a cybersecurity  policy,  cyber  crisis  management  plan,  a  gap  assessment  vis-a-vis  the  baseline requirements indicated in the circular, monitoring certain risk indicators in this area, report unusual cyber security incidents within 2 to 6 hours.

RBI has been carrying out IT Examination of banks from last year. RBI has also set up a Cyber  Crisis  Management  Group  to  address  any  major  incidents  reported  including suggesting  ways  to  respond  and  recover  to/from  the  incidents.  Department  of  Banking Supervision also conducts cyber security preparedness testing among banks on the basis of hypothetical scenarios with the help of CERT-In. RBI has also set up an IT Subsidiary, which would  focus,  among  other  things,  on  cyber  security  within  RBI  as  well  as  in  regulated entities.

*******