Cyberattacks Pose Growing Financial Threat to Indian Banks and NBFCs

Financial institutions in India are facing escalating risks from cyber incidents that extend beyond immediate monetary losses, impacting operational stability, regulatory compliance, and long-term profitability.

Financial Impact of Cybersecurity Incidents

Cybersecurity breaches generate substantial financial burdens for banks and NBFCs, even when initial fraud amounts appear modest. Beyond direct financial theft, institutions must account for costs related to forensic audits, system restoration, customer compensation, legal disputes, and regulatory penalties. Investments in enhanced cybersecurity infrastructure and technology upgrades further increase operational expenditures. Smaller financial entities are particularly vulnerable, as significant cyber-related losses could erode capital reserves and disrupt core operations.

Recent Banking Fraud Case

A notable incident involved two Mumbai-based NBFCs that allegedly lost approximately $2 million after hackers exploited an application programming interface (API) linked to ICICI Bank. Attackers initiated over 700 unauthorized transfers between October 8 and 9 by compromising the system used for loan-disbursement instructions. This breach underscored how compromised credentials and inadequate transaction controls can facilitate fraudulent transactions through legitimate banking channels. The incident raised concerns about the security of systems connecting banks with lending platforms and financial technology providers.

Third-Party Technology Providers as Vulnerability Sources

Banks increasingly depend on external service providers for digital lending, payment processing, and customer data management. While these partnerships enable automation and data exchange, poorly secured interfaces create entry points for cyber threats. CERT-In issued a warning on October 9 about attacks leveraging stolen credentials from payment aggregators, gateways, and partner banks. The advisory highlighted suspicious activities, including unauthorized transfers, fabricated loan references, and transactions routed through mule accounts. A single compromised third-party provider could expose multiple financial institutions to simultaneous risks.

Findings from Data Breach Investigations

State Bank of India is investigating a potential data exposure after 375,000 records reportedly surfaced on the dark web. A preliminary review identified 3,897 records containing personally identifiable information (PII), though the bank stated there was no material impact on operations. AU Small Finance Bank is separately examining a data leak involving a third-party software platform that stored limited vehicle-loan customer data. The institution confirmed its internal systems remained unaffected and services continued uninterrupted. Independent verification of the breach’s scope remains pending.

Regulatory Responses and Mitigation Strategies

The Reserve Bank of India (RBI) has intensified oversight of cybersecurity compliance, focusing on API vulnerabilities and emerging threats linked to artificial intelligence. In an October 19 advisory, the regulator instructed institutions to treat potentially exposed technology environments as compromised until forensic assessments confirm their security. CERT-In also flagged risks associated with AI agents accessing live systems via exposed credentials and misconfigured cloud environments. Financial institutions are urged to implement stronger authentication protocols, continuous transaction monitoring, independent beneficiary verification, and regular third-party security audits.

Implications for Financial Stability

Cybersecurity is evolving from a technical concern to a critical factor in financial stability. Successful attacks can lead to direct financial losses, regulatory scrutiny, operational disruptions, and eroded customer trust. As financial systems become more interconnected, robust cybersecurity measures are essential to safeguard sensitive data, ensure profitability, and strengthen institutional resilience against emerging threats.