2026 IDRBT .bank.in registry — 5,576 bank admin records exposed via unauthenticated APIs (~13 months)

Verified security-research disclosure — reported June 2026. After the Reserve Bank of India mandated exclusive .bank.in domains for banks in February 2025, researcher Srikanth L (CashlessConsumer) found the IDRBT registration portal exposed more than 33 unauthenticated REST API endpoints for about 13 months, allowing anyone to retrieve bcrypt password hashes, mobile numbers, emails, login IPs, and device fingerprints for all 5,576 bank employees trusted to manage India's .bank.in namespace—no login required. The investigation also documented 1,072 orphaned super-admin accounts, vendor IKCON Technologies holding global super-admin access, widespread missing DNSSEC/DMARC on registered domains, and some cooperative banks hosting sites on foreign servers contrary to RBI localization expectations. IDRBT reportedly closed the exposed APIs within roughly two weeks after early-June 2026 disclosure; RBI/IDRBT public incident statements were limited at catalog time. BreachHistory indexes 5,576 exposed administrator records (not retail customer accounts). Distinct from retail banking breaches—risk concentrates on domain/DNS hijack and targeted phishing against bank IT staff who control the anti-phishing namespace itself.