₹300 Crore NBFC Cybersecurity Losses have been reported across smaller NBFCs in about two months have brought payment API security, digital lending infrastructure and operational risk into focus.
What happened?
Indian non-banking financial companies (NBFCs), particularly smaller lenders, have reportedly suffered estimated losses of nearly ₹300 crore through cyberattacks over a period of around two months.
An investigation published by The Economic Times on October 29, 2026, cited people familiar with the incidents and reported that nearly 150 complaints or FIRs had been filed. The reported losses include an incident involving a Delhi-based NBFC that allegedly lost ₹7.5 crore in one attack and another ₹7.25 crore a few days later.
The report indicated that many of the affected lenders had relatively small operations, with turnover of around ₹1,000 crore or below. The figures are estimates based on information shared with the publication; they are not a consolidated loss figure officially published by the Reserve Bank of India (RBI) or CERT-In.
The incidents have also brought attention to the use of artificial intelligence (AI)-assisted tools in cybercrime. However, this does not establish that AI was used in every reported attack.
How were the attacks carried out?
The October 9, 2026 advisory issued by the Indian Computer Emergency Response Team (CERT-In), titled Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities, provides details of the methods identified across multiple attack campaigns.
The advisory covers NBFCs, digital lending platforms, fintech companies, payment service providers and wallet operators.
The reported attack sequence involved gaining access to internet-facing applications, exposed application programming interfaces (APIs) or privileged systems. Attackers then obtained payment gateway, payment aggregator or partner-bank API credentials.
These credentials were allegedly used to initiate fund transfers directly through the financial institution's authorised infrastructure.
The method is important because the transactions could be initiated without following the usual sequence of checks within the lending application. These checks may include loan creation, customer verification, KYC, loan sanction, beneficiary verification and transaction limits.
CERT-In identified several techniques associated with these incidents:
- Exploiting vulnerabilities in internet-facing applications and application server software.
- Accessing deprecated, unused or inadequately secured APIs.
- Stealing API tokens and credentials stored in source code or configuration files.
- Using compromised credentials to initiate unauthorised disbursements.
- Submitting fictitious loan or transaction reference numbers.
- Transferring funds to mule accounts through banking channels.
- Removing or tampering with system logs to complicate investigation.
In some cases, fraudulent transfers reportedly exceeded prescribed per-transaction limits. The advisory also noted that funds were moved through IMPS and NEFT channels and transferred to accounts controlled by the attackers.
Where does AI fit into these attacks?
AI-assisted tools - in the wrong hands, have reduced the time and technical effort required to identify vulnerabilities, prepare targeted attacks and automate certain activities. It has also helped people who earlier did not have the necessary technical tools to undertake such an attack to be able to undertake in such endeavours now.
The October 29 Economic Times report referred to tools such as CyberStrike and Artex, along with AI models including DeepSeek, Alibaba's Qwen, Moonshot's Kimi and Zhipu's GLM.
The report stated that investigators had identified the CyberStrike platform in some cases where investigations had been completed. It also referred to expert assessments of the use of AI toolkits and language models in cyberattacks.
These references however need to be distinguished carefully; only the availability of a general-purpose AI model, an offensive cybersecurity toolkit as opposed to producing a specific attack framework are not necessarily the same thing. Their mention in reporting does not establish that AI was used in every incident.
CERT-In's October 9 advisory however has used a more measured language. It identifies the 'possible' use of AI-assisted offensive tooling and notes that the time between an initial system compromise and fraudulent fund transfers has reduced in some recent incidents.
The operational concern is the combination of compromised credentials, exposed APIs and automated attack methods. Where payment systems rely on credentials or network permissions without independently validating each transaction, unauthorised transfers may be initiated through interfaces that the institution itself uses for legitimate operations.
Why payment APIs are central to the issue
APIs allow different software systems to exchange information and instructions. In digital lending, they may connect an NBFC's loan-management platform with a bank, payment gateway, payment aggregator or other service provider.
For example, when a loan is approved, the lending platform may send a disbursement instruction to a partner bank through an API.
A secure transaction should not depend only on whether the API request comes from an authorised system or contains valid credentials. The receiving system should also verify whether the transaction itself is legitimate.
That means checking whether (this is purely an example):
- The loan or payment reference exists in the institution's records.
- The customer and beneficiary have been verified.
- The disbursement has received the required approval.
- The amount is within the applicable limits.
- The transaction follows the authorised sequence of checks.
- The payment instruction has not already been processed.
If these checks are not all independently enforced at the payment stage, possibly stolen credentials may allow an attacker to initiate transfers without completing the normal lending workflow.
The issue also extends beyond the NBFC itself. Banks, technology vendors, payment aggregators and fintech partners may form part of the same transaction chain. Security controls therefore need to now cover the interfaces and credentials connecting these systems even more rigorously than usual.
What has CERT-In advised financial institutions to do?
CERT-In's advisory CIAD-2026-0046 sets out a range of technical and operational measures for financial institutions.
These include:
- Multi-factor authentication: Apply MFA to payment platforms, administrative portals, banking APIs and remote access systems.
- API management: Maintain an inventory of APIs and formally disable unused, deprecated or unnecessary interfaces.
- Credential security: Avoid long-lived static tokens, secure API keys and credentials in dedicated secrets-management systems, and rotate them regularly.
- Transaction validation: Ensure every payout is linked to an approved loan or payment record. Reject fictitious or unrecognised transaction references.
- Additional approvals: Use maker-checker controls or second-level verification for fund movements.
- Transaction limits: Enforce per-transaction and cumulative daily limits at the API and payment levels.
- Beneficiary verification: Validate beneficiary details and monitor unusual transaction volumes or newly added beneficiaries.
- Monitoring and reconciliation: Monitor fund transfers in real time and reconcile system records against bank or payment-provider statements.
- Log management: Maintain centralised logs for at least 180 days and protect them against unauthorised modification or deletion.
- Security testing: Conduct regular vulnerability assessments and penetration testing, including API security testing.
The advisory also recommends restricting unnecessary internet exposure of internal applications, separating development and production environments, and preserving forensic evidence when suspicious activity is detected.
These controls are relevant not only to NBFCs but also to other financial entities that rely on digital payment and disbursement infrastructure.
RBI's regulatory framework for cybersecurity and fraud risk management
The RBI has issued directions covering information technology governance, information security, cybersecurity, operational controls and fraud risk management for regulated entities.
Two relevant directions are:
1. RBI (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023
Issued on November 7, 2023, these directions came into effect on April 1, 2024. They cover IT governance, third-party arrangements, access controls, information security, cybersecurity risk management, vulnerability assessments, penetration testing, incident response and business continuity.
For NBFCs, their applicability is based on the RBI's scale-based regulatory framework. The directions cover NBFCs in the Top, Upper and Middle Layers; they do not apply uniformly to every NBFC.
2. RBI (Fraud Risk Management in NBFCs) Directions, 2024
Issued on July 15, 2024, these directions establish requirements for fraud prevention, early detection, reporting and related governance.
They apply to NBFCs in the Upper and Middle Layers and Base Layer NBFCs with an asset size of ₹500 crore or above, subject to the provisions of the directions.
Separately, Reuters reported on October 30, 2026, that the RBI had sought information from banks about cybersecurity compliance, API vulnerabilities and preparedness for AI-related risks. The report also referred to recent unauthorised transfers involving two Mumbai-based non-bank lenders.
The regulatory framework and the reported incidents concern several connected areas: technology governance, API security, third-party access, transaction validation and fraud monitoring. The extent to which individual institutions meet the applicable requirements needs to be assessed from their disclosures and regulatory information.
What does this mean for NBFC investors?
For investors evaluating an NBFC, cybersecurity is part of the institution's operational-risk profile. A cyber incident can affect financial performance and business continuity through several channels. Be educated and aware of the possible risks; while these may not directly impact depositors in the bank, the attacks may impose a financial cost on the NBFCs Eg.
Direct financial losses: Unauthorised transfers may result in losses if funds cannot be recovered from recipient accounts.
Recovery and remediation costs: Investigations, forensic audits, system restoration and security upgrades can add to operating expenses. These measures are not inexpensive nor an easy fix in today's ever growing sea of newer threats in the Cyver realm.
Business disruption: Payment systems, loan disbursements and customer-facing services may be temporarily restricted while vulnerabilities are investigated and addressed.
Third-party exposure: An NBFC's risk may depend partly on the security arrangements of banks, fintech companies, technology vendors and payment service providers with which it is connected.
Reputation and customer relationships: Cyber incidents may affect customer confidence, lending relationships and the ability to acquire or retain customers.
A cyberattack does not automatically indicate deterioration in an NBFC's loan book or credit quality. However, a large unrecovered loss can affect liquidity, profitability and capital, depending on the size of the loss and the institution's financial position.
Investors should therefore distinguish between the immediate operational impact of a cyber incident and its potential consequences for the company's financial statements.
What should NBFC depositors understand?
An important distinction exists between deposits held with banks and deposits accepted by NBFCs.
The Deposit Insurance and Credit Guarantee Corporation (DICGC) provides deposit insurance of up to ₹5 lakh per depositor per insured bank, in the same right and capacity. The limit includes both principal and interest.
This insurance cover applies to eligible deposits held with insured banks. It does not extend to deposits placed with NBFCs.
An NBFC's registration with the RBI also does not automatically mean that it is authorised to accept public deposits. Only NBFCs that meet the applicable requirements and have the necessary RBI authorisation can accept public deposits.
A cyberattack does not, by itself, cancel an NBFC's contractual obligation to repay deposits according to the agreed terms. However, if a lender suffers substantial unrecovered losses, its ability to meet payment obligations may be affected by its liquidity, capital position and overall financial condition.
Depositors considering an NBFC deposit should examine:
- Whether the NBFC is specifically authorised by the RBI to accept public deposits.
- Its credit rating and any recent rating actions or outlook changes.
- Its audited financial statements, capital position and liquidity.
- Its repayment history and any reported delays.
- The maturity period, interest rate and terms of the deposit.
Higher interest rates should be assessed alongside the credit and liquidity risks of the institution. Depositors should also avoid treating an NBFC deposit as equivalent to an insured bank deposit.
What should investors monitor from here?
The reported incidents provide several areas for investors and analysts to monitor when assessing NBFCs and the broader financial-services sector.
Cybersecurity disclosures: Whether the institution has reported a cyber incident, the nature of the incident and the financial impact, where disclosed.
Financial impact: Any provisions, write-offs, recoveries, insurance claims or exceptional expenses arising from the incident.
Technology and third-party controls: Whether the NBFC has reviewed API access, payment integrations, credential management and the security arrangements of external service providers.
Operational continuity: Whether lending, collections, disbursements and customer services are functioning normally following an incident.
Regulatory developments: Any additional directions, disclosures or compliance requirements issued by the RBI or CERT-In.
There is also a need to distinguish between a reported cyber incident, an allegation under investigation and a confirmed financial loss. The number of complaints or FIRs should not automatically be treated as the number of confirmed successful attacks or final losses.
Summary of Observations – 10 Key Points
1. Estimated losses of ₹300 crore: Smaller Indian NBFCs reportedly suffered cyberattack-related losses of nearly ₹300 crore over approximately two months.
2. Nearly 150 complaints/FIRs: The reported incidents include multiple unauthorised fund transfers, with some individual losses running into several crores.
3. Compromised payment APIs: Attackers allegedly accessed API credentials and exploited payment and disbursement systems to initiate fraudulent transfers.
4. AI-assisted cybercrime: Tools and AI models may have helped identify vulnerabilities, automate attacks and lower the technical barriers for potential attackers. AI involvement has not been confirmed in every incident.
5. CERT-In advisory: Its October 9, 2026 advisory (CIAD-2026-0046) specifically highlighted attacks targeting payment and disbursement APIs across financial institutions.
6. Security controls required: Recommended measures include multi-factor authentication, API protection, transaction validation, maker-checker approvals, beneficiary verification and real-time monitoring.
7. RBI regulatory framework: Existing RBI directions cover IT governance and fraud risk management for specified categories of NBFCs, based on their regulatory layer and asset size.
8. Financial impact on NBFCs: Cyberattacks can lead to direct losses, recovery expenses, business disruption, reputational damage and pressure on liquidity and profitability.
9. Depositor protection: Depositors are presently not at risk from the information we have gathered however, large impacts on smaller NBFCs cannot be ignored. We must be aware of concentration risk of our capital in individual NBFCs. Note: NBFC deposits are not covered by DICGC's ₹5 lakh bank deposit insurance. Depositors should verify RBI authorisation, credit ratings, liquidity and repayment history.
10. What investors should monitor: Cybersecurity disclosures, financial losses, recoveries, third-party technology risks, operational continuity and regulatory developments. A cyberattack does not automatically mean deterioration in loan-book quality.
Author
S. Harish Chandan
SEBI Registered Research Analyst
SEBI Registration No.: INH000012768
BSE RAASB Enlistment No.: 5826
Website: https://www.raharishchandan.com
Disclaimer
This article is for information and investor-awareness purposes only. It is based on publicly available information and cited reports as of November 1, 2026. Reported losses, incidents and investigative findings are attributed to the sources cited and should not be treated as independently audited or officially consolidated figures unless expressly stated.
This article does not constitute investment advice, a recommendation to buy, sell or hold any security, or a solicitation to invest in any financial product. Readers should undertake their own due diligence and consult their financial or legal advisers where appropriate.
References
- The Economic Times – October 29, 2026: AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months
- CERT-In – October 9, 2026: Advisory CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities
- Reuters – October 30, 2026: India's RBI tightens cyber checks on lenders after spate of hacks
- The Economic Times – October 15, 2026: Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures
- RBI – November 7, 2023: Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices
- RBI – July 15, 2024: Master Directions on Fraud Risk Management in NBFCs
- RBI: NBFC Depositors – Information for Depositors
- DICGC: Guide to Deposit Insurance
