Cybercriminals hacked the server of a fintech company in Sector 65, Noida, and siphoned off Rs 2,42,62,576 through 497 unauthorised transactions executed in about eight hours.

According to police, the money was moved to 58 bank accounts spread across 28 banks. A case has been registered at the Cyber Crime Police Station on a complaint filed by the company’s director.

The company provides mobile recharges, bill payments, Aadhaar-enabled Payment System cash withdrawals and domestic money transfers. Police say the unauthorised activity took place on its server and API portal between around noon and 8 pm on September 13.

The fraud surfaced only during a routine review of transactions, when officials noticed hundreds of entries the company had not authorised. Investigators are examining whether automated scripts were used, though the exact method of intrusion has not been established.

API-based attacks have become a favoured route for financial cybercrime, since one vulnerability can allow high-volume transfers before detection. Police have advised fintech firms to audit API access controls and monitor for anomalous patterns.