Cybercriminals Steal $2.65 Million from Tamil Nadu Rural Development and Panchayat Raj Department’s HDFC Bank Account

Hackers drained approximately $2.65 million (₹22,30,04,879 or ₹22.3 crore) from the Single Nodal Account of the Tamil Nadu Rural Development and Panchayat Raj Department held at HDFC Bank. The funds, earmarked under the 15th Finance Commission Health Sector Grants for rural primary healthcare, were siphoned in 46 unauthorised electronic transfers between 12 and 30 October 2026.

Account and Access Architecture

The Single Nodal Account was maintained in the name of the Director of Rural Development and Panchayat Raj, Government of Tamil Nadu, at HDFC Bank’s CIT Nagar branch in Chennai. Payments were processed through the Squareuplive.com/rdprd portal developed by Lead Winner Corp for HDFC Bank’s Single Nodal Account system.

Only authorised Block Development Officers could initiate transfers, using individual user IDs and passwords under a maker-checker dual-authorisation framework. No other officials had the authority to approve payments. Investigators are examining whether attackers compromised credentials, the third-party portal, OTP/multi-factor authentication systems, or a combination of these.

Digital traces indicated shifting IP addresses linked to Bangladesh, the United States and Greece.

Breakdown of Fraudulent Transfers

The unauthorised debits were routed through maker-checker credentials mapped to three Block Development Offices:

• Mandapam Panchayat Union, Ramanathapuram district: approximately $1.67 million (₹14 crore)
• Dharapuram Panchayat Union, Tiruppur district: approximately $0.60 million (₹5 crore)
• Keelaiyur / Nagapattinam: approximately $0.37 million (₹3.1 crore)

Current Account as mule accounts in several banks

The money was transferred to roughly 25 beneficiary (mule) accounts held by entities including Samvyadh Marketing, Krishna Kirana Store, Nexvora Commerce Private Limited, Heyinz Infrastructure Private Limited, Octave Limited and others.

Discovery, Complaint and Arrests

K.R. Ramprasad, a Block Development Officer and Superintendent attached to the Directorate of Rural Development and Panchayat Raj, filed a formal complaint with the Chennai Commissioner of Police. The matter was also reported on the National Cyber Crime Reporting Portal. Greater Chennai Police’s Central Crime Branch Cyber Crime Wing registered a case on 3 November 2026.

On 14 November 2026, police arrested seven people identified as money mules or agents who supplied bank accounts and facilitated the movement of funds: Chellapandian (56) and Karumbu Annadurai (56) of Chennai, Loganathan (65) of Bengaluru, Abdul Rahman (28) and Jagadeesh (31) of Madurai, and Ashraf Ali and Kannadasan of Sivaganga. Mobile phones, SIM cards, cheque books and passbooks were seized. Recovery efforts are ongoing.

The case has drawn comparisons with a parallel incident in neighbouring Puducherry, where approximately $1.05 million (₹8.84 crore) was siphoned from the Government Dental College’s account at HDFC Bank.

Regulatory and Policy Implications

The transfers raise questions about compliance with Reserve Bank of India standards. RBI’s Cyber Security Framework in Banks (2016), the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (2023), and the July 2026 Cybersecurity Directions require multi-factor authentication (with at least one dynamic factor), independent maker-checker controls, continuous monitoring of high-value and anomalous transactions, and robust oversight of material third-party systems.

Under the Master Direction on Outsourcing of Information Technology Services (2023), HDFC Bank retains primary responsibility for the security of the Squareuplive portal used for Single Nodal Account operations. The prolonged access and delayed detection of 46 high-value transfers are inconsistent with these outcome-based standards. Controller General of Accounts advisories for SNA/PFMS users further require non-sharing of credentials and OTPs, strong password hygiene, and the use of official email addresses only.

Greater Chennai Police have advised government officials handling internet banking to avoid sharing credentials or OTPs, rotate passwords regularly, enable multi-factor authentication, monitor accounts daily, and ensure departmental portals obtain CERT-In certification. The incident highlights residual risks in India’s public-finance digitisation when large Single Nodal Account balances sit behind distributed, password-based access mediated by third-party portals.