NBFC cyberattacks in India have siphoned off an estimated ₹300 crore over roughly two months, mostly from smaller non-banking financial companies, people familiar with the cases said. Nearly 150 complaints or first information reports have been filed.
Key Takeaways
- Some lenders have faced repeated attacks, including one in Delhi that lost ₹7.5 crore and then ₹7.25 crore in separate incidents.
- CERT-In has warned that attackers can exploit payment APIs and has identified possible use of AI-assisted tools.
NBFC cyberattacks hit smaller lenders
The estimate, reported on October 29, 2026, covers attacks across India over approximately the preceding two months. People familiar with the cases said the affected companies were largely lenders with turnover of about ₹1,000 crore or less.
Some 30 complaints have been filed in Mumbai, more than 25 in Delhi and 15 to 16 in Chennai, with others in additional cities, the people said. Cybersecurity agencies are advising lenders to upgrade their infrastructure.
How attackers exploit payment systems
In an October 9 advisory, the Indian Computer Emergency Response Team, or CERT-In, described attacks on lenders and other financial entities that involved stolen payment credentials and unauthorized transfers. Its warning on payment and disbursement APIs said attackers could use an institution’s own approved infrastructure to bypass application-level checks.
CERT-In said its analysis indicated possible use of AI-assisted offensive tools in those attacks. In a separate October 15 advisory, the agency said AI tools had shortened the time between initial access and impact in a financially motivated campaign, while some organizations were attacked again after incomplete remediation.
The agency recommended measures including multi-factor authentication, secure storage and rotation of credentials, transaction limits and real-time monitoring of fund transfers.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
Comments
Be respectful. No spam, impersonation or private credentials. Ordinary posts and comments appear immediately; suspicious links are held for review.
Please wait…