It seems that UPI and BHIM apps have been hacked and so far, only Bank of Maharashtra has reported the issue.
The 50 accused sent various money transfer requests of up to Rs 1 lakh each over a period of 48 days to accounts held with BoM (Bank of Maharashtra) through UPI.

The gaps are likely to be at the software company level which may have developed the application for the respective banks.
An Infrasoft spokesperson said, “We have reported losses from December 1 but we got to know about it on January 18. There is a “collect money” feature on UPI which was used by fraudsters who opened fake accounts using fake SIM cards…The investigation is on and more details should be out soon.”
Update from Infrasoft : Moneycontrol has this detail mixed up from the original Times of India article the states that the Bank incurred these losses beginning December 1, 2016. http://timesofindia.indiatimes.com/city/pune/bom-files-fir-against-50-people-in-upi-fraud/articleshow/57582564.cms
Source: Moneycontrol