AI-powered cyberattacks have reportedly siphoned off about Rs. 300 crore from smaller non-banking financial companies (NBFCs) across India over roughly two months, resulting in more than 150 first information reports (FIRs) being filed, the Economic Times reported, citing “highly placed sources”.

According to the Economic Times:

  • The attackers primarily targeted smaller NBFCs with a turnover of about Rs. 1,000 crore or less.
  • In one reported case, a Delhi-based NBFC lost Rs. 7.5 crore in one attack and another Rs. 7.25 crore a few days later.
  • Cybersecurity agencies have reportedly traced some completed investigations to CyberStrike, a Chinese hacking platform.
  • Experts quoted in the report believe that attackers are combining two Chinese AI toolkits, Artex and CyberStrike, with open-source models such as DeepSeek, Qwen, Kimi and GLM.

“Cyberattacks used to happen earlier also but for the past one and a half months, they have become rampant, with some companies witnessing repeated attacks,” an anonymous source told the Economic Times.

Why this matters: How should the public learn about cyberattacks, data breaches or financial losses resulting from such incidents? Ideally, not through news media reports. The regulators responsible for cybersecurity in India, including the Reserve Bank of India (RBI), CERT-In and CSIRT-Fin, the financial security arm of CERT-In, should disclose such information.

However, neither CERT-In’s public advisories on these attacks nor any RBI notices mention the loss figures reported by the Economic Times.

The generic and vague nature of these public advisories leaves customers, borrowers and other stakeholders dependent on media reports, if such incidents are reported at all, to learn about cyberattacks affecting financial institutions.

More concerning is that financial institutions appear to acknowledge such incidents officially only after information emerges through unofficial channels. For instance:

The Economic Times also reported that CERT-In has advised organisations to prioritise alerts linked to Artex and CyberStrike. However, none of the public notices issued by CERT-In so far specifically mentions any affected company or entity.

What CERT-In has said about recent cyberattacks

October 9: CERT-In and CSIRT-Fin, its financial-sector arm, issued a “Critical” advisory to NBFCs, digital lenders, fintechs, payment service providers and wallet operators.

The advisory describes how attackers steal payment gateway and partner-bank application programming interface (API) credentials and then directly access disbursal APIs. This allows them to bypass KYC checks and per-transaction limits.

However, the advisory does not name any affected entity or identify the specific threat actors or their modus operandi. It also does not disclose how many incidents CERT-In has recorded or the amount of money stolen, according to its records.

October 15: A second advisory warned about AI agents accessing Indian systems without authorisation. It stated that attackers with financial motives had conducted cyber campaigns against Indian entities using publicly available, AI-native offensive security frameworks.

However, the advisory did not specifically identify the tools used or name any affected entities.

October 27: CERT-In conducted a full-day drill involving more than 300 officials from over 55 financial institutions, predominantly regional rural banks and cooperative banks. Its public post does not mention NBFCs or any financial losses.

What are the reporting timelines for data breaches?

  • CERT-In: Its 2022 directions require organisations to report cybersecurity incidents within six hours of noticing them.
  • RBI: Its July 2026 directions require NBFCs to report cyber incidents through its DAKSH platform within six hours.
  • SEBI: It requires regulated market entities to report cybersecurity incidents to SEBI and CERT-In within six hours of detection. This is followed by additional disclosures. Listed companies also have reporting obligations to stock exchanges, typically within 12 hours.
  • DPDP Act: The law requires the Data Protection Board of India (DPB) to be informed within 72 hours, while affected individuals must be notified “without delay”.

What are the disclosure obligations of data fiduciaries in case of a data breach? 

Section 8(6) of the Digital Personal Data Protection (DPDP) Act requires data fiduciaries to notify both the DPB, which is yet to be fully established, and every affected individual about a personal data breach.

Rule 7(1) of the DPDP Rules, 2025, requires data fiduciaries to notify affected individuals “without delay” and in plain language. The notice must include:

  • A description of the breach, including its nature, extent and timing.
  • The consequences that are likely to arise for the affected individual.
  • The measures taken to mitigate the risks.
  • The safety steps that the individual can take.
  • The contact details of a person who can answer queries about the breach.

Under Rule 7(2), data fiduciaries must also inform the DPB without delay and submit a detailed report within 72 hours. This report must include findings on the cause of the breach and details of the notices sent to affected individuals.

However, this rule will come into effect only on May 13, 2027. It is also unclear whether these attacks involved the exposure of personal data, as CERT-In’s advisory describes incidents involving the theft of funds through payment APIs.

MediaNama has written to the RBI, SEBI, CERT-In and CSIRT-Fin seeking responses to the following questions. We will update this story with their responses.

Questions to the RBI:

  • Whether it can confirm ET’s estimate of Rs. 300 crore in losses and nearly 150 complaints, and how many NBFCs have reported cyber incidents since August.
  • Whether its July 31, 2026 cybersecurity directions, or any other directions with a six-hour reporting window, apply to NBFCs.
  • Whether NBFCs are required to tell customers about cyber incidents that affect their funds or data, and if not, whether the RBI will issue such a direction pending the DPDP Rules.
  • Whether it has taken or is considering supervisory action against any NBFC, and whether it will publish aggregate incident and loss data.

Questions to SEBI:

  • Whether any listed NBFC has disclosed these losses under Regulation 30 of the SEBI Listing Obligations and Disclosure Requirements Regulations, 2015.
  • Whether SEBI considers cyber-fraud losses of this scale material for disclosure, and whether it will set timelines for disclosing cyber incidents.
  • Whether it has asked listed financial entities to confirm that affected customers were informed.

Questions to CERT-In and CSIRT-Fin:

  • How many NBFCs and fintechs have reported incidents under the October 9 advisory or earlier, and whether it can confirm ET’s figures.
  • When and how it alerted NBFCs about Artex and CyberStrike, as reported by ET, and whether alerts went beyond the published public advisories.
  • Whether it will publish aggregate, non-attributed data on incidents, losses and remediation status.
  • Whether it tracks if affected entities have informed their customers, and what it does after receiving an incident report.

Also read

The post Rs. 300 Cr lost in AI cyberattacks on NBFCs: Why did the public learn about it from the media, not regulators? appeared first on MEDIANAMA.