CBSE Portal Attack: 50 Students Breached Payment, Fees Hit Rs 68,000

Government sources said May 30, 2026 that ~50 students breached the CBSE revaluation portal via an HDFC gateway flaw, showing fees from Re 1 to Rs 67,000-68,000.

Government sources told PTI on May 30, 2026 that the CBSE revaluation portal payment system suffered a malicious attack in which 50 students gained unauthorised access and manipulated displayed fees , with some seeing amounts swing from roughly Re 1 to nearly Rs 67,000–68,000 . Officials linked the window of abuse to the HDFC payment gateway integration when the portal came back online after downtime. HDFC has since been removed , four public-sector bank gateways were tested, and the stack was moved to Amazon Web Services (AWS) with audits led by IIT Madras , IIT Kanpur , and the Digital Infrastructure Corporation of India .

This is India's highest-visibility payment-integrity failure on a national education portal this week, with a direct lesson for anyone building fee, billing, or gov-tech checkout flows.

The incident centers on the post-result / answer-sheet access and revaluation workflow for Class XII CBSE students, not the separate On-Screen Marking (OSM) evaluation system that CBSE publicly defended on May 26, 2026 against unrelated hacker claims.

According to government sources quoted across India TV , Times Now , The New Indian Express , and PTI :

A senior education official told The New Indian Express (May 29) that payment problems during answer-sheet access were caused by "mischief" by roughly 50 students who "hacked into the CBSE portal" , producing absurd quotes such as Rs 67,000 for sheet access for some users and Re 1 for others.

The user-visible failure mode was not silent data theft alone. It was erratic fee displays at checkout:

Sources said the anomalies affected 50 student cases where the amount had changed during the vulnerability window.

Separately, officials acknowledged roughly 20 instances where students received wrong scanned answer sheets (another person's copy), against ~11.38 lakh answer-sheet requests overall. That is a data-handling glitch at national scale, distinct from but adjacent to the payment manipulation story.

Government sources consistently traced the payment glitch to HDFC Bank's payment gateway embedded in the CBSE portal when it went live after being non-functional for some time .

Official narrative as of May 30 :

The New Indian Express named four PSU integrations tested smoothly: Bank of Baroda , Canara Bank , State Bank of India , and Indian Bank . Other outlets also listed Bank of Maharashtra in the PSU set. Treat the exact four-bank roster as ministry-confirmed at test time , with minor press variance on the fourth name.

On May 24, 2026 , Union Education Minister Dharmendra Pradhan met Finance Minister Nirmala Sitharaman payment and technical issues during CBSE's post-result and revaluation processes.

Outcomes described by May 30:

That AWS detail matters for developers: the fix path is not only "swap banks" but cloud scale + payment rail hardening under political deadline pressure.

On May 26 , CBSE denied that its production On-Screen Marking (OSM) evaluation portal was compromised, after West Bengal ethical hacker Nisarga Adhikary claimed CERT-In reporting and described severe issues including password leaks and master password in JS on a different URL than production.

The Hindu quoted CBSE saying the evaluation URL "has neither been compromised nor does it have the vulnerabilities indicated."

The May 30 payment attack on the revaluation / answer-sheet portal is what government sources described to PTI on Friday. Readers and SEO should not merge the two into one "CBSE hacked" headline without qualification.

Never trust client-displayed payment amounts. If ~50 users could make the UI show Re 1 or Rs 68,000, the architecture likely lacked server-side amount signing tied to order IDs, or allowed parameter tampering before redirect to the gateway.

Payment gateway cutover under outage pressure is high risk. Relaunching HDFC after portal downtime without canary traffic and amount integrity checks created a national incident.

Gov-tech needs the same controls as fintech: idempotent orders, HMAC-sealed fee payloads, audit logs per student roll number, and anomaly alerts when quoted amounts exceed policy bounds.

AWS scale does not fix authZ bugs. Moving to AWS solves capacity; it does not replace secure payment orchestration. See how enterprise stacks handle agentic load in Snowflake's $6B AWS commitment as contrast: big cloud spend plus governance, not cloud alone.

Supply-chain week context: This lands beside TrapDoor and ChatGPhish , showing trust failures across npm, AI UI, and now national fee portals .

Officials said payment gateway problems had been resolved after HDFC removal and PSU bank testing. Students should:

Government sources told PTI that the CBSE revaluation portal payment system was hit by a malicious attack in which 50 students gained unauthorised access and manipulated displayed fees, with some seeing Re 1 and others nearly Rs 67,000-68,000.

Officials described unauthorised access and manipulation by 50 students tied to the HDFC payment gateway window when the portal went live after downtime. Media and officials used terms including malicious attack, hacking, and mischief; treat legal attribution as pending unless law enforcement confirms.

Sources linked the glitch to the HDFC payment gateway integrated with the CBSE portal. HDFC was removed from the process and four public-sector bank gateways were integrated and tested instead.

No. CBSE separately denied on May 26, 2026 that its production On-Screen Marking evaluation portal was compromised, responding to ethical hacker claims a different URL. The May 30 story concerns the revaluation and answer-sheet access payment portal.

Removal of HDFC from the payment flow, integration and testing of PSU bank gateways, expert review by IIT Madras and IIT Kanpur with Digital Infrastructure Corporation of India, and migration of the portal infrastructure to AWS for capacity.

The AI & Dev Briefing

One honest email a week — what actually matters in AI and software engineering. No noise, no content. Read by developers across 30+ countries.

More on Cybersecurity

1,100 Ships GPS-Spoofed: Iran Switches to BeiDou, Apps Break

GPS spoofing put 1,100 ships at airports and nuclear plants in 2026. Iran switched to China's BeiDou, abandoning US GPS. What breaks and how developers build resilient location services.

Salt Typhoon: China Hacked 80 Countries and No One Got Them Out

Salt Typhoon, a Chinese state APT group, has compromised at least 200 companies across 80 countries including US telecom giants. AT&T and Verizon cannot confirm the hackers are out.

DarkSword iOS Exploit Kit Leaked on GitHub: 6 Chained Zero-Days Hack iPhones Silently

DarkSword — 6 chained vulnerabilities including 3 zero-days — leaked on GitHub March 23. Anyone can host it in minutes. 221M iPhones on iOS 18.4-18.6.2 are vulnerable. Full breakdown.

Itron Breach: 72-Hour Utility Stack Response Playbook for Infra

Itron disclosed a cyber incident affecting internal systems. This playbook maps utility-stack exposure, OT-IT controls, and the first 72-hour actions infra teams should run.

Software Engineer based in Delhi, India. Writes AI models, semiconductor supply chains, and tech geopolitics — covering the intersection of infrastructure and global events. 355+ posts cited by ChatGPT, Perplexity, and Gemini. Read in 121 countries.