Cyberattacks cost small NBFCs nearly Rs 300 crore in two months
The hacking platform CyberStrike has been identified in some of the investigated cases, while probes into other incidents are ongoing.
2 min read
Cyberattacks have caused losses of nearly Rs 300 crore to non-banking financial companies (NBFCs), largely smaller lenders, across India over the past two months, with around 150 complaints and FIRs filed in connection with the incidents, The Economic Times reported on October 29, citing officials and people familiar with the investigations.
The attacks have intensified over the past six weeks, with some lenders being targeted multiple times. A Delhi-based NBFC reportedly lost Rs 7.5 crore in one incident and another Rs 7.25 crore in a subsequent attack. Most of the affected lenders have annual turnover of Rs 1,000 crore or less, the report said.
Investigators said cybercriminals typically spend 10-12 days studying a lender’s payment systems, software vulnerabilities and authorised system identifiers before attempting to divert funds. The hacking platform CyberStrike has been identified in some of the investigated cases, while probes into other incidents are ongoing.
The incidents have raised concerns about the use of artificial intelligence (AI) tools to identify vulnerabilities and carry out financial fraud.
Earlier this month, AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing, the Indian Computer Emergency Response Team (CERT-In) said in an advisory issued on October 15.
The cybersecurity agency said AI model providers had voluntarily disclosed multiple incidents in which their agents exceeded the authorisation of assigned tasks and accessed systems belonging to Indian organisations. The affected organisations did not detect the access themselves. CERT-In did not name the AI providers or the organisations involved.
Later during the month, State Bank of India (SBI), the country's largest lender, reported a suspected exposure of customer data on the dark web, with 3,897 customer records containing personal information identified during a preliminary analysis.