Bengaluru cyber heist: How a plumber and class 10 graduate aided Rs 47 crore fintech hack

Cyber crime

In a sophisticated international cybercrime operation targeting a Bengaluru-based finance firm, police have arrested two men who allegedly facilitated the siphoning of nearly Rs 47 crore. The elaborate scheme involved hackers in Hong Kong, handlers in Dubai and a network of bank accounts across India.

According to a report by The Indian Express, the arrested individuals have been identified as Sanjay Patel, a 43-year-old plumber from Udaipur and Ismail Rasheed Attar, a 27-year-old from Belagavi who studied up to Class 10. They are accused of being key local players for the overseas criminals.

The investigation was launched on August 8 after a senior manager at Whizdm Finance Private Limited, which operates the ‘Moneyview’ instant loan app, filed a formal complaint. The firm reported multiple suspicious transactions executed in a narrow two-and-a-half-hour window between midnight on August 6 and 7, which drained the company's accounts.

Police Commissioner Seemant Kumar Singh stated that technical investigations revealed the scale of the breach: a staggering 1,782 unauthorised transactions were made from the company’s bank accounts, distributing the stolen funds across 656 different bank accounts nationwide.

An internal probe confirmed the transactions did not originate from the company’s official systems but from foreign internet protocol addresses.

The trail led investigators first to Patel. As detailed in The Indian Express report, his State Bank of India account in Udaipur had received Rs 27.39 lakh from the illicit transfers. The plumber was subsequently arrested on September 25.

A more complex layer of the operation was uncovered involving a Hyderabad-based entity, ‘Unknown Technologies Pvt Ltd’, to which Rs 5.5 crore was routed. The police traced these transactions to an IP address registered with Webyne Data Centre, a server hosting service. This digital footprint culminated in the arrest of Attar on October 9.

Attar, who worked as a digital marketer and offered freelance services online, was a critical link. A police officer explained that Dubai-based Indians had contacted Attar via the messaging app Telegram, renting five servers he had purchased from Webyne. “The servers would’ve been purchased for Rs 1,500 and rented for Rs 2,500,” the officer said.

These rented servers became the launchpad for the attack. The Dubai-based operatives had contracted hackers based in Hong Kong, who used the Webyne servers to breach Whizdm’s security systems. Posing as instant loan seekers, the hackers executed the unauthorised transfers, using IP addresses from Hong Kong and Lithuania to conceal their location and evade detection.

Commissioner Singh confirmed that efforts to recover the stolen funds are underway, stating that police have already recovered Rs 10 crore and are hopeful of retrieving the remainder.