AI-enabled cyberattacks have caused significant financial damage to India's smaller NBFCs, siphoning off nearly Rs. 300 crore in recent months. Despite multiple advisories from cybersecurity agencies, regulators have not publicly disclosed key details about the incidents, leaving the public reliant on media coverage for information.
- Rs. 300 crore stolen from NBFCs via AI cyberattacks in two months
- CERT-In and RBI advisories lack specific disclosures and affected entity names
- Digital Personal Data Protection rules on breach reporting take effect May 2027
What happened
Over the last two months, smaller Indian non-banking financial companies (NBFCs) have faced rampant AI-driven cyberattacks that resulted in the theft of approximately Rs. 300 crore. These attacks exploit weaknesses in payment gateway and partner-bank APIs, enabling attackers to bypass KYC checks and transaction limits to siphon funds directly. More than 150 first information reports (FIRs) have been lodged in relation to these security breaches.
CERT-In and its financial sector arm CSIRT-Fin issued cybersecurity advisories warning NBFCs, fintechs, digital lenders, and payment service providers about the ongoing threat. While these advisories described the nature of the attacks and urged caution, they did not name any specific affected companies or provide details on the extent of financial losses. Public knowledge primarily came through media reporting instead of official regulator disclosures.
Why it matters
The lack of detailed public disclosures from regulators like CERT-In and RBI raises concerns about transparency in India’s financial cybersecurity framework. Customers, investors, and other stakeholders remain uninformed about the scale and impact of these attacks unless they rely on media sources, which may delay or limit the dissemination of critical information. This opacity poses risks to trust and preparedness in the financial ecosystem.
India’s data breach notification rules under the Digital Personal Data Protection Act require affected entities to notify both the proposed Data Protection Board and impacted individuals promptly. However, these obligations only become fully enforceable from May 2027. Until then, incidents involving financial theft without clear data exposure remain ambiguously reported, complicating the regulatory landscape and crowding the information gap.
What to watch next
Stakeholders should monitor how and when Indian regulators update their reporting practices regarding cybersecurity incidents in the financial sector. The establishment and operationalization of the Data Protection Board will be critical for ensuring timely public breach notifications. Meanwhile, the RBI and CERT-In's future advisories may indicate evolving standards for transparency and crisis communication.
Industry participants, including NBFCs and fintech companies, will need to strengthen their internal controls around API security and adopt AI-resilient cybersecurity measures. Observers should also watch for any legislative or regulatory reforms triggered by these breaches that might mandate more explicit disclosures or improve the enforcement of data protection requirements in India’s financial domain.