Growing cyber risks

Threats call for stronger systemic safeguards

State Bank of India’s (SBI’s) disclosure that 3,897 customer records containing personal information were identified among about the 375,000  found on the dark web is a reminder that cybersecurity is no longer merely an information-technology (IT) concern. The exposed pieces of information reportedly include mobile numbers, addresses, dates of birth and loan-related details. SBI says its operations and financial performance remain unaffected and is investigating the source and extent of the exposure. But for customers, the concern is different. Such information can make impersonation, phishing and other fraud more credible. The fact that SBI was alerted by the threat-intelligence provider, the Defence Cyber Agency, and Computer Emergency Response Team (CERT-In) also raises questions about the ability of large institutions to detect breaches themselves. 

The risks extend beyond data theft. The Reserve Bank of India (RBI) data shows that digital-payment frauds account for the largest number of cases of bank fraud. CERT-In has also warned of attacks on non-banking financial companies (NBFCs), digital lenders, fintechs, payment-service providers, and wallets. The threat is becoming harder to contain because artificial intelligence (AI) lowers the cost and time of attacks. Earlier this month, CERT-In issued a critical advisory in which AI agents accessed live systems and confidential records of Indian organisations without authorisation; none of the affected organisations detected the access themselves. Attackers are also using agentic AI tools for financially motivated intrusions. The lesson is that conventional weaknesses, including exposed credentials, poorly secured application programming interface (API), and excessive cloud permissions, become considerably more dangerous when machines can exploit them at speed and scale.

The recent eMudhra certificate incident illustrates the wider problem of digital trust. CERT-In has warned that compromised private keys could be used to issue fraudulent certificates and impersonate legitimate websites. A weakness at any layer, such as banks, fintechs, cloud-service providers, APIs or digital-certification infrastructure, can, therefore, have consequences beyond the organisation directly affected. The regulatory response must consequently go beyond operational resilience. India already has cybersecurity and fraud-risk frameworks under the RBI, while the Digital Personal Data Protection (DPDP) Act, 2023, provides for notifying personal-data breaches to affected individuals. Yet the relevant DPDP provisions and rules are subject to staggered commencement, with the principal breach-notification provisions taking effect only 18 months after the November 2025 notification. This leaves a crucial gap in the interim. Informing regulators and reassuring investors are not a substitute for warning customers whose data may have been exposed. 

It should be mandated that regulated entities notify affected customers promptly when there is credible evidence of a material personal-data exposure, without waiting for an investigation to establish every detail. Banks and financial firms should also be held to enforceable standards on API security, third-party risk, cloud access, and AI-agent permissions. CERT-In’s guidance on limiting agent access, isolating testing environments, requiring human approval for high-impact actions, and maintaining tamper-resistant logs should become part of operational practice rather than merely advice. India’s digital-financial architecture has expanded rapidly. Its security framework must now evolve at the same pace. The objective should not merely be to ensure that banks continue to function after an attack, but to ensure that customers are protected, informed and able to act when security fails.