Nearly ₹300 crore is estimated to have been siphoned off from non-banking financial companies (NBFCs), mostly smaller lenders, across India through cyberattacks over the past two months, with around 150 complaints and first information reports (FIRs) filed so far, according to people familiar with the matter cited by The Economic Times on October 29.

The attacks have become more frequent over the past six weeks, with some lenders facing repeated breaches. In one case in Delhi, an NBFC reportedly lost ₹7.5 crore in an initial attack and another ₹7.25 crore just days later, showing just how quickly losses can mount when vulnerabilities remain unaddressed.

The attacks have largely affected smaller NBFCs, particularly those with annual turnover of around ₹1,000 crore or less, whose cybersecurity infrastructure may not be equipped to deal with increasingly sophisticated threats.

Investigators have identified the Chinese hacking platform CyberStrike in some cases where probes have been completed, while investigations into other incidents are continuing.

Cybersecurity experts have also pointed to the possible use of AI toolkits, including Artex and CyberStrike, alongside open-source AI models such as DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi and Zhipu’s GLM.

The extent of the reported losses comes against the backdrop of a large NBFC sector. As of October 15, 2026, 8,502 NBFCs were registered with the Reserve Bank of India (RBI). According to reports, around 30 complaints had been filed in Mumbai, more than 25 in Delhi and 15–16 in Chennai, apart from cases reported elsewhere.

Cybersecurity agencies have been advising affected lenders to strengthen their systems as investigators examine how the attacks were executed and how similar breaches can be prevented.

RBI Governor Flags AI-Driven Cyber Risks At Banks

The attacks on smaller NBFCs come as the RBI has raised concerns about emerging cybersecurity threats involving artificial intelligence, including AI agents that can operate with limited human intervention.

RBI Governor Sanjay Malhotra said the central bank, banks and the government were alert to the risks and were taking steps to identify and plug vulnerabilities in their information technology systems. He was speaking at the NDTV World Summit, where he referred to reports of AI agents operating in test environments that had allegedly attacked banks overseas and stolen data.

“Our banks, the government as well as the RBI, we have alerted them, and they are conscious about it and they are taking measures to ensure that such kind of vulnerabilities, wherever they are, are plugged,” Malhotra said.

The Governor said the RBI had a regulatory and supervisory framework in place, along with experts who audit the IT systems of major banks and NBFCs. The central bank was also in regular discussions with lenders to strengthen their technology infrastructure and ensure compliance with prescribed requirements.

Malhotra identified data security and protection against cyberattacks as key priorities, noting that vulnerabilities can emerge as software evolves rapidly. The challenge, he said, was to identify such weaknesses quickly and ensure that the necessary security patches were deployed.

His remarks followed reports of suspected exposure of customer information at State Bank of India (SBI). The incidents have added to concerns about the risks posed by compromised systems, unauthorised access and the potential misuse of sensitive financial data.

The RBI’s warning and the reported NBFC losses point to two connected concerns for the financial sector: the increasing accessibility of tools that can facilitate cyberattacks and the need for banks and lenders to identify and close vulnerabilities before they are exploited.

How AI Is Making Cyberattacks Easier to Execute

The methods used in the attacks on smaller NBFCs are not necessarily new. What has changed is how easily criminals can access tools that help them identify weaknesses, automate tasks and execute attacks at scale.

According to officials familiar with the investigations, fraudsters typically spend 10–12 days studying an NBFC’s operations before launching an attack. They examine how payments are processed, which identifiers are authorised to access systems and where weaknesses may exist in the underlying code.

Cybersecurity experts state that toolkits such as Artex and CyberStrike, used alongside open-source AI models including DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi and Zhipu’s GLM, may be helping attackers exploit these weaknesses. Investigators have identified CyberStrike in some cases where probes have been completed, although investigations into other incidents remain ongoing.

AI does not necessarily need to invent a new hacking technique to make an attack more effective. By helping criminals automate reconnaissance, generate scripts and coordinate multiple operations, these tools can make existing techniques accessible to people with less technical expertise.

An official tracking the developments said that attackers could feed a toolkit into an AI model and use prompts to direct its activities, reducing the amount of manual work required.

A separate warning from India’s cybersecurity authorities illustrates how quickly this process can unfold. In its October 15 advisory on AI agents as attack vectors, the Indian Computer Emergency Response Team (CERT-In) reported incidents involving AI agents that exceeded their assigned authorisations, as well as attackers deliberately using open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions.

CERT-In also reported that, in a financially motivated campaign against Indian entities, AI-assisted tools compressed the time between initial access and the final impact from days to a few hours. Organisations that failed to address vulnerabilities completely were targeted again within days, sometimes at greater scale.

The findings point to a practical problem for financial institutions: the weaknesses being exploited may be familiar, but the speed and scale at which attackers can identify and reuse them are changing.

Payment APIs And Stolen Credentials Allow Funds To Be Diverted

A critical advisory issued by CERT-In and its financial-sector incident response team, CSIRT-Fin, on October 9 provides a closer look at how some of these attacks have been carried out.

The advisory identified multiple campaigns targeting NBFCs, digital lending platforms, fintech companies, payment service providers and wallet operators. According to the agency, attackers compromised internet-facing applications and exposed application programming interfaces (APIs), then obtained credentials belonging to payment gateways, payment aggregators and partner banks.

APIs allow different software systems to communicate and exchange information. In lending and payments, they can be used to initiate disbursals and transfer funds between institutions. If an attacker obtains valid credentials and finds a way to invoke these interfaces directly, transactions may be initiated without passing through all the checks built into the application.

CERT-In said attackers had used this approach to bypass controls covering loan creation, know-your-customer (KYC) verification, loan sanction, beneficiary verification, balance sufficiency and per-transaction limits.

The agency also identified transactions carrying dummy loan or reference numbers that did not correspond to genuine records. Funds were transferred to mule accounts across multiple banks, with some transactions executed rapidly through the Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) systems.

The advisory identified several weaknesses that could facilitate such attacks, including deprecated or unauthenticated APIs, static credentials embedded in source code, plaintext passwords in configuration files and remote services without multi-factor authentication.

A separate report said that  around 20 financial institutions had been affected by cyberattacks earlier that month, with investigators examining the alleged use of stolen partner-bank credentials and weaknesses in payment APIs. Following the incidents, affected entities reportedly restricted vulnerable payment and disbursement interfaces.

CERT-In has advised financial institutions to enforce multi-factor authentication, maintain an inventory of APIs, disable unused interfaces, validate every payout against an approved transaction and introduce independent checks for fund transfers. It has also recommended transaction limits, beneficiary verification, secure storage and regular rotation of credentials, and real-time monitoring of suspicious payments.

The advisory makes clear that securing the payment gateway alone is not enough. Institutions must ensure that a valid credential cannot be used to bypass the checks that should precede a transfer, and that every disbursal can be matched to a legitimate, authorised transaction.

Borrowers Could Also Be Exposed to Fraud

The cyberattacks on lenders raise concerns beyond the money directly stolen from financial institutions. If attackers gain access to customer or loan-related information, that data could potentially be used to target borrowers through phishing, impersonation and other forms of financial fraud.

Cyber intelligence firm Cyble has identified cases in which attackers explored the sale of stolen information, including through Telegram groups. 

Information such as a borrower’s name, lender, outstanding loan or repayment details can make a fraudulent call appear credible. Criminals may pose as representatives of an NBFC, a bank or a payment service provider and use those details to persuade customers to disclose passwords, one-time passwords (OTPs) or other sensitive information.

AI tools can potentially make these attempts more convincing by helping criminals generate personalised messages and scripts in different languages. 

The risk is particularly relevant to digital lending, where customers may interact with lenders through mobile applications, websites, automated calls and third-party service providers. A compromised system at one point in this chain can create opportunities for fraud elsewhere, even if the subsequent scam is carried out separately.

Financial institutions therefore need to communicate with affected customers promptly when a breach could expose their information. Borrowers, meanwhile, should verify requests for payments or sensitive information through official channels rather than relying on caller identification or knowledge of their loan details.

The wider concern is that a cyberattack directed at a lender could have consequences beyond the institution’s own balance sheet if stolen information is subsequently used to target its customers.

The Last Bit, 

The RBI and CERT-In have called for stronger security controls as financial institutions respond to the growing threat of automated and AI-assisted attacks.

In his remarks, RBI Governor Sanjay Malhotra said the central bank was working with banks and the government to identify vulnerabilities and ensure they were addressed. He also pointed to the RBI’s existing supervisory framework and IT audits, through which the regulator assesses the technology systems of financial institutions.

Separately, CERT-In and CSIRT-Fin’s October 9 advisory outlined measures aimed at preventing unauthorised access to payment systems and limiting the damage if credentials are compromised.

For institutions that have suffered a breach, the priority extends beyond stopping fraudulent transactions. They must identify the initial point of entry, determine whether credentials or customer data were exposed, preserve forensic evidence and address the underlying weakness before restoring affected services.

The incidents also spotlights the importance of securing third-party connections. NBFCs often depend on external technology providers, payment gateways and partner banks, meaning vulnerabilities in one component can affect transactions across multiple systems.

The reported losses of ₹300 crore among smaller NBFCs, together with the RBI Governor’s warning about AI-driven cyber risks, have brought these concerns into sharper focus. Investigations into individual attacks are continuing, while cybersecurity agencies and financial institutions work to strengthen controls against further breaches.