AI-led attacks reportedly drain Rs 300 crore from NBFCs
CERT-In has warned lenders about AI-aided theft through loan disbursal APIs. Reports of Rs 300 crore in losses are unconfirmed by regulators.
Attackers using AI tools have reportedly siphoned about Rs 300 crore from smaller non-banking finance companies (NBFCs) over roughly two months, MediaNama reported on 30 October, citing an earlier Economic Times report that relied on unnamed "highly placed sources". Neither the Reserve Bank of India (RBI) nor India's cyber agency CERT-In has confirmed the figure. What is on the public record is a pair of CERT-In warnings in October to lenders and payment firms about attacks that move money through loan disbursal systems.
What has been reported and what has been confirmed
According to MediaNama's summary, the losses fall on smaller NBFCs with a turnover of about Rs 1,000 crore or less. More than 150 police complaints (FIRs) have reportedly been filed, though MediaNama's own questions to the RBI refer to "nearly 150 complaints". One Delhi-based NBFC reportedly lost Rs 7.5 crore in one attack and Rs 7.25 crore a few days later.
These numbers have not been confirmed by a regulator. The CERT-In advisories described below do not name any affected company, any attacker group, the number of incidents or any loss amount. That gap between press reports and official notices is the central fact of this story.
What CERT-In has actually said
CERT-In's 9 October advisory, rated "Critical", went to NBFCs, digital lenders, fintechs, payment providers and wallet operators. As MediaNama describes it, attackers steal credentials for payment gateways and partner-bank APIs, then use the lender's disbursal APIs to push out money. An API is the connection that lets one software system instruct another; a disbursal API is the one that sends a loan amount to a borrower's account. By going through it, attackers can bypass KYC checks and per-transaction limits.
A second advisory on 15 October warned that AI agents were accessing Indian systems without authorisation using AI-native offensive security frameworks, without naming the tools or victims. A 27 October drill with over 300 officials from 55-plus institutions, mostly rural and cooperative banks, did not mention NBFCs or losses publicly.
The tools and the attribution
The Economic Times, as relayed by MediaNama, links some investigations to CyberStrike, described as a Chinese hacking platform, and says experts believe attackers pair it with a tool called Artex and open-source AI models. MediaNama notes that no public CERT-In notice mentions those names, so these attributions are unverified.
Why disclosure is patchy
MediaNama points to other cases where the public learned of losses from outside sources: Central Bank of India's Rs 13.97 crore loss surfaced through a police complaint, and CoinDCX's chief executive called breach reports a false alarm before admitting a Rs 152 crore loss three days later.
Reporting rules exist. CERT-In's 2022 directions and RBI's July 2026 directions, which route NBFC reports through its DAKSH system, both require incidents to be reported within six hours. Listed companies notify exchanges, typically within 12 hours. It is unclear whether these attacks involved personal data, since the advisories describe theft of funds through payment APIs.
What it means for lenders and borrowers
For small NBFCs, the lesson is about keys: API credentials for payment gateways and partner banks are the target, so who holds them and what limits the disbursal API enforces are board-level questions. Nothing in the advisories suggests borrowers' accounts are being emptied; the risk is to the lender's own funds and, if losses are large, its ability to keep lending. For banks and investors that fund NBFCs, the concern is disclosure: if losses surface only through police complaints, risk is priced on incomplete information.
What to watch next
- Whether the RBI, SEBI or CERT-In answer MediaNama's pending questions and confirm or correct the Rs 300 crore estimate.
- Whether any listed NBFC discloses a loss to the stock exchanges.
- Whether regulators publish aggregate incident and loss data.
Key takeaways
- A report relayed by MediaNama says AI-aided attacks took about Rs 300 crore from small NBFCs in two months; regulators have not confirmed this.
- CERT-In's 9 and 15 October advisories warn of theft through loan disbursal APIs and unauthorised AI agents but name no victims or losses.
- Tool names such as CyberStrike and Artex appear in press reports but not in any public CERT-In notice.
- NBFCs must report cyber incidents to RBI within six hours, yet public disclosure has mostly come from media and police complaints.
- The Rs 300 crore figure is the Economic Times' report, repeated by MediaNama and VARINDIA, so treat it as unverified.
Sources
- [MediaNama: AI cyberattacks reportedly siphon Rs 300 crore from NBFCs](https://www.medianama.com/2026/10/223-ai-cyberattacks-siphon-rs-300-crore-nbfcs/)
- [VARINDIA: AI-powered cyberattacks drain Rs 300 crore from NBFCs (relays the Economic Times report)](https://www.varindia.com/news/ai-powered-cyberattacks-drain-rs-300-crore-from-nbfcs)
Tags: NBFC Cybersecurity CERT-In AI security Digital lending