India's .bank domain mandate backfires as registry leaks sensitive data

India's central bank required banks to use .bank domains to boost trust, but the registry's open API exposed sensitive information like names, phone numbers, and email addresses of bank officials. The leak could enable attackers to impersonate bank staff. The flaw was discovered by security researchers and highlights risks in mandated domain systems.