MediumII Cyber Warfare & Critical Infrastructure29 October 2026, Thursday

India's small finance companies lose 3 billion rupees to cyberattacks

According to an Economic Times report of 29 October, about 3 billion rupees (300 crore) was siphoned from small non-bank finance companies in two months, with some 150 complaints or criminal reports filed. The figure rests on investigative sources; the central bank, the RBI, has not confirmed it.

Location: MUMBAI

The losses fall on NBFCs, which lend without a banking licence. According to a compilation by Inventiva, there are about 30 complaints in Mumbai, more than 25 in Delhi and 15–16 in Chennai. One Delhi company lost 7.5 crore rupees, then another 7.25 crore a few days later. Attackers reportedly studied each company for 10–12 days and moved the money to mule accounts via IMPS and NEFT. The RBI had 8,502 registered NBFCs as of 15 October.

CERT-In, the state cyber emergency response unit, issued two alerts on 9 and 15 October. The second said AI-assisted tools had cut the time from initial access to outcome from days to hours. Investigators name the tools CyberStrike and Artex, but the role of AI in individual incidents is still under investigation. On 27 October CERT-In ran a drill with more than 300 officials from over 55 institutions, mostly rural and cooperative banks.

Liability is also shifting to banks: the Supreme Court said on 29 October that banks must cover customer losses where due diligence was lacking. Government data show 21,928 'digital arrest' complaints between January and August, involving more than 647 crore rupees. A change to the RBI's authentication rules is expected by 30 November, though the framework is not yet final. The sources do not say how much of these losses was covered by cyber policies; data on cover and premiums could not be verified.

Talay assessment

Bottom line

In India, cyber risk is settling on the weakest link: small finance companies whose payment apps have grown faster than their security. The 3 billion rupee estimate is small for the system, but attack times falling to hours call the speed of supervision into question. The most likely path is tougher minimum security requirements from the RBI for small institutions; the thesis weakens if official loss data come in below the estimate.

Likely effects

Small finance companiesNegative1–6 months
As security investment becomes mandatory, the cost burden rises for the smaller players among the 8,502 registered NBFCs.
Bank liabilityNegative1–6 months
If the Supreme Court's approach is confirmed, part of fraud losses could shift from customers to banks.
Cyber insuranceUncertain6 months+
If liability shifts to institutions, demand for cover could rise; with no premium or coverage data, this reading remains an assumption for now.

Possibilities, ranked

1
Regulatory tightening60%
The RBI tightens security audits and patching deadlines for small NBFCs; attacks continue but losses become visible.
Watch: An RBI cyber-security circular for NBFCs and the authentication change due by 30 November
2
Attacks jump to larger institutions25%
The same tools are used against mid-sized firms, and losses per incident rise.
Watch: A reported loss above 100 crore rupees in a single incident, or a new CERT-In alert
3
Estimate is revised down15%
The official tally comes in below 3 billion rupees, and some incidents prove to be insider jobs.
Watch: A verified total-loss statement from the RBI or the police

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Estimated NBFC losses▼ ~3bn rupees
Complaints/criminal reports▼ ~150

Bottom line

Likely effects

Possibilities, ranked

Sources