Smaller Indian NBFCs have lost over ₹300 crore in two months to AI-enabled cyberattacks using tools like CyberStrike and ARTEX. These breaches highlight gaps in digital infrastructure at smaller firms, prompting urgent warnings from CERT-In to strengthen IT security protocols and address the rising operational risks to financial stability.
Smaller Indian non-banking financial companies (NBFCs) are facing a spike in cyber fraud, with losses estimated at ₹300 crore over the last two months. These attacks, which have triggered at least 150 first information reports, are increasingly using automated AI toolkits to bypass digital defenses. The scale and speed of these incursions present a significant operational challenge for institutions that may not have the resources of larger, systemic lenders.
Security experts have identified platforms like CyberStrike and ARTEX as the primary tools behind this surge. These systems use artificial intelligence to automate the reconnaissance process—the act of mapping a network for weaknesses—and carry out phishing and interface cloning in a fraction of the time required by traditional hackers. The speed of these attacks allows them to compromise systems and move funds within hours, rather than days.
For investors and stakeholders, the core concern lies in the vulnerability of smaller NBFCs. Firms with annual turnovers under ₹1,000 crore often operate with constrained budgets for digital infrastructure. While large banks and major NBFCs have the resources to implement robust, real-time monitoring and advanced security layers, smaller entities often rely on legacy systems that may not be fully equipped to fend off sophisticated, AI-driven threats.
The Reserve Bank of India (RBI) has long emphasized the need for strong cyber resilience. In its guidelines on Information Technology Governance, Risk, and Controls, the regulator mandates that financial institutions must maintain clear oversight of their digital risks and implement comprehensive security measures. The recent wave of attacks suggests that some entities may be falling short of these expectations. When a company is breached, the financial impact extends beyond the immediate loss of funds. It can also lead to higher operational costs, increased cybersecurity insurance premiums, and the necessity for larger provisions for operational losses, which can directly affect profitability in quarterly earnings.
The Indian Computer Emergency Response Team (CERT-In) has advised firms to mobilize their Red Teams—internal groups that simulate cyberattacks to identify vulnerabilities—and to proactively scan for signs of the specific tools currently being used in these campaigns. Moving forward, market observers will likely focus on whether these smaller NBFCs can accelerate their spending on IT security. Investors may want to monitor management commentary regarding cybersecurity investments and any changes in operational risk provisions during upcoming quarterly results to gauge how these firms are navigating the threat landscape.