Cybercriminals siphon Rs 22.3 cr from Tamil Nadu rural healthcare funds

Cybercriminals allegedly siphoned off Rs 22.30 crore from a bank account maintained by Tamil Nadu’s Rural Development and Panchayat Raj Department. The money, allocated for rural healthcare infrastructure, was transferred through 46 unauthorised transactions using the department’s online banking system.The fraud came to light after KR Ramprasad, a Block Development Officer and Superintendent attached to the Directorate of Rural Development and Panchayat Raj, lodged a complaint with the Chennai Police Commissioner. According to the complaint, Rs 22,30,04,879 was transferred from the department’s Single Nodal Account with HDFC Bank’s CIT Nagar branch between October 12 and 30.The account, held in the name of the Director of Rural Development and Panchayat Raj, contained funds released by the Union and Tamil Nadu governments under the Fifteenth Finance Commission’s Health Sector Grants. The grants, covering the period from 2021-22 to 2025-26, are intended to strengthen primary healthcare infrastructure and services in rural areas through Rural Local Bodies.The department had authorised Block Development Officers of Block Panchayats to operate the account and make payments to contractors through an online portal. Each officer was provided an individual user ID and password, and transactions required authorisation through a maker-checker system. No other person was authorised to initiate or approve payments.The complaint alleges that unidentified persons gained unauthorised access to the account and transferred the money without the knowledge or approval of the department. Preliminary verification of bank statements and transaction records revealed 46 electronic debits that had not been initiated or approved by any authorised official.The transactions were reportedly routed through maker and checker accounts mapped to Block Development Offices in Keezhaiyur in Nagapattinam district, Mandapam in Ramanathapuram district and Dharapuram in Tiruppur district. The complaint alleges that the credentials associated with these offices were misused to facilitate the transfers.The money was transferred to accounts belonging to several companies and individuals across the country. The entities named in the complaint include Samvyadh Marketing, Krishna Kirana Store, Pchandr Group, Bharat Grain, Nexvora Commerce Private Limited and M/S K H B Brick Field. Heyinz Infrastructure Private Limited, Octave Limited, MMABS Private Limited and NAKSRAJ Tour and Travels were also among the companies named.The online portal used to manage the HDFC Bank Single Nodal Account was reportedly hosted at Squareuplive.com/rdprd and developed by a company named Lead Winner Corp. Investigators are examining how the portal was accessed and whether its security was compromised.The complaint says it is yet to be established whether the fraudsters stole the login credentials of authorised officials, exploited a vulnerability in the banking portal or compromised the one-time password (OTP) and other authentication systems. It has sought a detailed technical and cyber forensic investigation to identify how the unauthorised access was obtained.Police are also examining whether the perpetrators used malicious links to gain control of the portal. Preliminary investigations reportedly suggested that the website may have been accessed around September 12 or 13, with the perpetrators spending several days examining its vulnerabilities before diverting the funds. Investigators are also looking into suspicious access attempts recorded from Bangladesh, the United States and Greece, and whether anyone within the department or outside assisted the fraud.The complaint was also submitted through the National Cyber Crime Reporting Portal. It has sought an investigation into the unidentified cybercriminals and anyone who may have facilitated or benefited from the transactions. The department has asked the police to identify and freeze the beneficiary and intermediary bank accounts to prevent further withdrawals.It has also sought the preservation of transaction logs, IP addresses, device details, login and session histories, OTP and authentication records, registered mobile numbers, beneficiary account KYC details and CCTV footage. The department has requested the police to trace the diverted money, identify those responsible and facilitate the recovery of the entire amount.The Chennai Central Crime Branch's Cyber Crime Wing has registered a case under five sections and launched an investigation. Police are tracing the beneficiary accounts and examining digital records to establish the route through which the money was diverted.