Indian non-banking financial companies, predominantly smaller institutions, are estimated to have lost approximately ₹300 crore through cyberattacks over the past two months. The figure is based on information from nearly 150 complaints and first information reports and should therefore be treated as a reported estimate rather than a final consolidated loss figure issued by a regulator or law-enforcement agency.
NBFCs with annual turnover of up to approximately ₹1,000 crore accounted for much of the reported exposure. Around 30 complaints were filed in Mumbai, more than 25 in Delhi and approximately 15 to 16 in Chennai. One Delhi-based lender reportedly lost ₹7.5 crore during an initial intrusion and another ₹7.25 crore in a subsequent attack only days later, illustrating the risk of repeat compromise when the original vulnerability has not been fully contained.
The attackers were reported to have combined automation and artificial-intelligence tools with reconnaissance of payment systems, approved identifiers and internal transaction patterns. Tools identified in the investigation include Artex and CyberStrike, alongside open-source AI models such as DeepSeek, Qwen, Kimi and GLM. The presence of these tools does not by itself establish who directed the attacks or their country of origin; attribution remains a separate investigative question.
The operating pattern described in the complaints involved attackers observing the target’s payment environment and writing customised code over periods of approximately 10 to 12 days. Once access was established, fraudulent transactions could be routed through processes designed to appear consistent with legitimate payment activity. Cybersecurity officials have observed that AI-assisted techniques can reduce the interval between initial access and financial damage from several days to a matter of hours.
The episode places particular attention on smaller lenders that have digitised origination, underwriting and disbursement operations without equivalent investment in continuous security monitoring. Relevant controls include segmentation of payment systems, behavioural transaction analysis, rapid credential rotation, strict privileged-access management and immediate post-incident remediation. Investigations remain active, and the reported loss total may change as duplicate complaints are reconciled and additional cases are validated.
