India’s central bank mandated use of .bank domains to enhance trust – but its registry leaked sensitive info

A security researcher reported that the Institute for Development and Research in Banking Technology (IDRBT), the sole registrar for India’s .bank.in namespace, exposed an open REST API with 33+ unauthenticated endpoints that allegedly allowed access to bcrypt password hashes, mobile numbers, email addresses, login IPs and device fingerprints for roughly 5,576 bank employees; the researcher claims many .bank.in domains lack DNSSEC/DMARC and that the portal ran without proper security audits for about 13 months before the issues were fixed following disclosure.