50 Students Breach CBSE Payment Portal in Cyberattack
Severity: Medium (Score: 51.9)
Sources: Siasat, Devdiscourse
Published: · Updated:
Keywords: cbse, breach, portal, payment, system, malicious, attack
Severity indicators: breach, rat, cyberattack
Summary
The CBSE revaluation portal was compromised by around 50 students who gained unauthorized access, exploiting vulnerabilities in the payment system linked to HDFC Bank. This breach caused erratic fee displays, with amounts fluctuating from Rs 1 to Rs 68,000. The incident is suspected to be either a prank or malicious manipulation. Experts from IIT Madras and IIT Kanpur are working to strengthen the system's security. Four public sector banks are collaborating with CBSE to enhance the payment gateway infrastructure. The portal has been migrated to Amazon Web Services (AWS) to improve reliability and capacity. Discussions regarding the incident were held between government officials and the finance minister. The situation is currently under investigation, with efforts underway to rectify the vulnerabilities. Key Points: • Around 50 students exploited vulnerabilities in the CBSE revaluation portal's payment system. • The breach resulted in erratic fee displays, with amounts ranging from Rs 1 to Rs 68,000. • IIT experts and public sector banks are collaborating to enhance the portal's security.
Detailed Analysis
**Impact** Approximately 50 students gained unauthorized access to the CBSE revaluation portal’s payment system, affecting fee payment processes. The breach caused abnormal fee displays, with payable amounts fluctuating between Rs 1 and Rs 68,000. The incident impacted the education sector in India, specifically the CBSE’s digital examination and revaluation services, potentially disrupting financial transactions and student records. The scope is limited to the payment gateway integration involving HDFC Bank and the CBSE portal. **Technical Details** The attack exploited vulnerabilities in the payment gateway integrated with HDFC Bank on the CBSE revaluation portal. The breach occurred shortly after the portal went live, causing manipulation of fee amounts displayed to users. No specific malware, CVEs, or detailed TTPs were disclosed. The system infrastructure includes integration with four public sector banks and migration to Amazon Web Services (AWS). The attack corresponds to initial access and manipulation stages of the kill chain. **Recommended Response** Immediate actions include conducting a thorough code and system audit of the payment gateway integration, focusing on HDFC Bank’s interface. Strengthen authentication and input validation controls to prevent unauthorized manipulation of fee amounts. Monitor transaction logs for irregular payment activities and implement multi-bank payment gateway redundancy. Continue collaboration with IIT Madras, IIT Kanpur, and Digital Infrastructure Corporation of India to apply security patches and validate system integrity.
Source articles (2)
- CBSE Payment System Breach Exposes Malicious Attack — Devdiscourse · 2026-05-29
The CBSE revaluation portal recently experienced a security breach, giving approximately 50 students unauthorised system access. Sources within the government highlighted the payment gateway associate… - 50 children breach CBSE portal in cyberattack — Siasat · 2026-05-30
New Delhi: The CBSE revaluation portal’s payment system was hit by a “malicious attack”, with around 50 students gaining unauthorised access, government sources said on Friday. “There were some unauth…
Timeline
- 2026-05-24 — Government discussions on payment issues: Union Finance Minister Nirmala Sitharaman and Pradhan discussed recent payment and technical issues affecting students.
- 2026-05-29 — Breach confirmed in CBSE payment system: Approximately 50 students gained unauthorized access to the CBSE revaluation portal, exploiting the HDFC payment gateway.
- 2026-05-30 — Ongoing investigations and system upgrades: Experts from IITs and Digital Infrastructure Corporation are examining the system to enhance security and fix vulnerabilities.
Related entities
- Data Breach (Attack Type)
- CBSE (Company)
- Education (Company)
- AWS (Company)
- India (Country)