InfoSecBulletin Cybersecurity for mankind
Bangladesh’s digital payments system remains severely disrupted after a technology conflict forces core card and interbank services offline for millions of users. The outage affects infrastructure linked to 33 commercial banks and highlights operational and regulatory risks in the country’s heavily concentrated payments network.
According to The Business Standard and tradersunion, the disruption is linked to a dispute between Information Technology Consultants Ltd, operator of the Q-Cash network, and Russian vendor Compass Plus over a planned software migration to OpenWay’s WAY4 platform.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
ITCL says Compass Plus installed a disruptive script on its servers after learning it was being replaced. According to ITCL, the script restarts the servers every eight hours, erases routing tables and shuts down processing capacity across the network.
Kazi Saifuddin Munir, managing director and chief executive officer of ITCL, says the company alerted bKash and partner banks after identifying the issue. He adds that customer data remains secure and says services are expected to resume after Bangladesh Bank intervenes.
The conflict intensifies after ITCL notifies Compass Plus in August that it plans to phase out the platform over a 12-to-18-month transition. ITCL alleges the vendor then threatens to withdraw technical support and demands an immediate $1.5 million migration fee, along with advance payment guarantees backed by Bangladesh Bank.
Regulatory scrutiny and banking impact deepen
Bangladesh Bank intervenes on Monday and attempts to resolve the standoff through discussions with the vendor and ITCL, but central bank officials express dissatisfaction with the shutdown being carried out without prior notice.
Arief Hossain Khan, executive director and spokesperson for Bangladesh Bank, says the technical problem is causing major hardship for cardholders and confirms the regulator will issue formal show-cause notices to affected member banks.
Officials from the central bank’s Payment Systems Department say ITCL had originally been scheduled to carry out the migration near the end of October. A central bank official says ITCL instead informs regulators on Sunday evening that services must be taken offline immediately, a move the official says breaches the regulatory framework for critical payment infrastructure.
ITCL provides payment processing and gateway infrastructure to 33 commercial banks and supports services tied to the National Payment Switch Bangladesh, ATMs, point of sale terminals, cash recycling machines and internet banking fund transfers. Industry estimates indicate the company handles about 70% of the country’s banking-card transactions.
A notice on ITCL’s website logs the maintenance window from 9pm on Sunday, 4 October, to 12pm on 10 October. The outage leaves consumers unable to complete purchases, withdraw cash or check balances through mobile apps, while banks warn of reputational damage from the abrupt suspension.
Mahfuzur Rahman, chief financial officer of Trust Bank, says member banks receive notice only on the day services are shut down and have no time to warn customers. He says Trust Bank’s debit cards continue to work on international Visa and local NPSB networks, but its credit cards, prepaid cards and Q-Cash ATM network remain unavailable.
