Rising API Threats: Nepal Bots and Leaked Keys Cause $130k Damages on US Tech

Post Views: 6

US Technology Firm Suffers Significant Financial Loss Due to API Attacks and Possible Insider Involvement

A recent cybercrime case has come to light in which a US-based technology company has suffered substantial financial losses due to alleged unauthorized API access and potential insider participation.

The Incident: A Complex Attack on Multiple Fronts

The incident occurred in December 2025, when the company detected over 120,000 suspicious API requests on its servers, resulting in significant system strain and financial losses. According to preliminary cyber forensic analysis, the attacks were carried out using an automated bot network, routed through Virtual Private Network (VPN) infrastructure and IP addresses linked to Nepal.

According to investigators, “the attackers may have exploited stolen or leaked API keys to execute the attack, causing inflated operational costs and disrupting business operations.”

Insider Involvement Suspected

The company’s authorized legal representative has filed a formal complaint with the authorities, initiating an investigation at the Dhoomanganj police station. The probe is ongoing, with investigators tracing the last valid login session to Prayagraj, leading them to suspect possible insider involvement.

Shubham Shukla, a former employee, has been identified as a key suspect, with his IP range allegedly associated with the suspicious activity.

Repercussions and Lessons Learned

The company also reported repeated unauthorized API hits on third-party data platforms, including LexisNexis, during the same time frame. These repeated requests led to unexpectedly high billing charges, exacerbating the overall financial damage.

Cybersecurity experts believe this incident highlights the growing risks associated with API security and insider threats in modern digital ecosystems. They emphasize the importance of adopting multi-layer authentication, continuous log monitoring, and strict access control policies to prevent similar incidents in the future.

Ongoing Investigation

The investigation remains ongoing, with authorities working to map the complete digital network behind the attack and identify all individuals involved.