More Stories

Informist, Monday, Jul. 20, 2026

MUMBAI – The Securities and Exchange Board of India Monday imposed aggregate penalties of INR 10 million on Central Depository Services (India) Ltd. for contravention of cyber security norms for depositories while dealing with a malware attack Nov. 18, 2022. While levying the fine on Central Depository Services, SEBI observed that "the malware attack was the foreseeable outcome of lapses that had built up over time". The regulators found lapses by Central Depository Services were exploited by the threat actor and enabled the malware attack.

The adjudication stemmed from a root cause analysis which concluded that the ransomware attack on servers and computers was a result of the failure of Central Depository Services to adequately secure a server used for allowing its employees to work remotely during the COVID-19 pandemic. The analysis had found that the Central Depository Services had failed to test the servers for any vulnerabilities.

The regulator had initiated adjudication proceedings against the market infrastructure institution and its chief information security officer and chief technology officer for flouting norms related to cyber security which enabled the ransomware attack in 2022. The regulator also examined whether the officers of Central Depository Services had put the reputation on the jeopardy or had failed to comply with any applicable securities laws.

In its order, SEBI found that Central Depository Services had not adhered to high standards of services, exercise of due diligence, and proper care expected from a registered intermediary. However, the regulator found that since the allegations against the market infrastructure institution's officers could not be established, they could not be attributed liability under the relevant norms.  End

Reported by Prateem Rohanekar

Edited by Akul Nishant Akhoury

For users of real-time market data terminals, Informist news is available exclusively on the NSE Cogencis WorkStation.

Cogencis news is now Informist news. This follows the acquisition of Cogencis Information Services Ltd. by NSE Data & Analytics Ltd., a 100% subsidiary of the National Stock Exchange of India Ltd. As a part of the transaction, the news department of Cogencis has been sold to Informist Media Pvt. Ltd.

Informist Media Tel +91 (22) 6985-4000

Send comments to feedback@informistmedia.com

© Informist Media Pvt. Ltd. 2026. All rights reserved.