India markets regulator penalises depository over 2022 malware attack
FILE PHOTO: The logo of Securities and Exchange Board of India (SEBI) is seen on its headquarters in Mumbai, India, March 24, 2025. REUTERS/Hemanshi Kamani/File Photo
MUMBAI, July 20 : India's markets regulator on Monday imposed a fine of 10 million rupees on Central Depository Services (India) Ltd (CDSL) for multiple cybersecurity and compliance failures linked to a malware attack that disrupted depository operations in November 2022. Here are the key details
• The regulator said the Indian depository, which handles 83 million, or 70 per cent of the country's investor accounts, had failed to classify an internet-facing server as a critical asset and to safeguard it, despite rules requiring such systems to be treated as such.
• This server was the root cause of the malware attack. By failing to secure this asset, the depository allowed cyber threats to gain access to its systems.
• SEBI also found that the depository failed to detect intrusions in real time, to properly analyse security alerts and to comply with rules for resuming trade settlement through backup sites.
• The attack disrupted critical depository functions including settlement activities, corporate actions, margin pledges and inter-depository transfers, delaying settlements scheduled for 18 November 2022, SEBI said.
• SEBI noted that the malware attack was the foreseeable outcome of accumulated cyber-security lapses, including inadequate monitoring, weak password controls and failure to implement required cyber-security safeguards.
