The Securities and Exchange Board of India (Sebi) on Monday imposed a total penalty of Rs 1 crore on Central Depository Services (CDSL). The penalty amounts for alleged failures in cybersecurity measures identified after a malware attack in November 2022.
Critical systems, including the settlement process and inter-depository transfer, were disrupted for 46 hours and 54.5 hours, respectively, SEBI said. It makes it evident that the disruption had a major spillover impact on the entire securities market.
Further, SEBI noted that the malware attack was a foreseeable outcome of lapses built up over time, including unwarranted policy deviations, unimplemented regulatory directions, and the absence of certain cybersecurity measures.
Forensic investigation indicated that attackers first gained access to CDSL’s network in November 2021, almost a year before the malware attack was detected on Nov. 18, 2022. The regulator said the prolonged compromise underscored shortcomings in CDSL’s cyber monitoring framework.
“It is important to highlight that the attacker had gained access to the servers of Noticee No. 1 in November 2021 itself, while the attack was discovered in November 2022. Adding to that, CDSL created an admin account in 2021 whose password was set to never expire, and its relaxation regarding the lockout threshold to three failed attempts was not addressed until the malware attack,” as per the SEBI order.
The order added that the interconnectedness and interdependency of the depositories pose broader implications for cyber risk.
The malware attack disrupted several depository services, including settlement, transfer and pledge transactions, forcing market participants to defer settlements over the weekend.
Recently, the company received approval to invest Rs 20 crore in India International Bullion Holding IFSC Ltd (IIBHL), marking its entry into India’s growing bullion market infrastructure.
The investment will be executed in phases, with the first tranche of Rs 10 crore expected to be completed by August 2, 2026.
SEBI Penalises CDSL Of Rs 1 Crore For Failures In Cybersecurity Measures
