Sebi imposes ₹1 crore penalty on CDSL for alleged cybersecurity lapses

Jul 20, 2026

The order added that the interconnectedness and interdependency of the depositories pose broader implications for cyber risk

The Securities and Exchange Board of India (Sebi) has imposed a total penalty of Rs 1 crore on Central Depository Services (CDSL) for alleged failures in cybersecurity measures identified after a malware attack in November 2022.

The market regulator noted that critical systems, including the settlement process and inter-depository transfer, were disrupted for 46 hours and 54.5 hours, respectively, making it evident that the disruption had a major spillover impact on the entire securities market.

The regulator further noted that the malware attack was a foreseeable outcome of lapses built up over time, including unwarranted policy deviations, unimplemented regulatory directions, and the absence of certain cybersecurity measures.

"It is important to highlight that the attacker had gained access to the servers of Noticee No. 1 in November 2021 itself, while the attack was discovered in November 2022. Adding to that, CDSL created an admin account in 2021 whose password was set to never expire, and its relaxation regarding the lockout threshold to three failed attempts was not addressed until the malware attack," the order noted.

The order added that the interconnectedness and interdependency of the depositories pose broader implications for cyber risk.

[The Business Standard]