NBFC Cyberattack: Two Indian Lenders Report Over Rs 7 Crore Stolen Five Days Apart as CERT-In Warns of Payment API Attacks
Spandana Sphoorty and Keerthana Finserv reported Rs 7 crore-plus in unauthorised transfers five days apart. Here is what is confirmed, what CERT-In warned about, and what to check this week.
Where India · Asia, South Asia
On this page 7 sections
Two Indian lenders have reported more than Rs 7 crore (70 million rupees) each leaving their bank accounts in unauthorised transfers, five days apart, in the same week India's national cyber agency issued a Critical warning about attacks on non-bank lenders. If your company's software can tell a bank to send money, the methods in that warning apply to you, wherever you operate.
No official source we could open links the two thefts to each other or to a named hacking group, so this post keeps what is confirmed apart from what is only suggested.
What happened in the NBFC cyberattacks
An NBFC, or non-banking financial company, is an Indian lender that is not a bank.
Spandana Sphoorty Financial, a microfinance lender, told India's stock exchanges on November 2, 2026 that about Rs 7.80 crore had been debited from one of its bank accounts on November 1, in multiple transactions to 82 beneficiary accounts. According to reports of the filing, it stopped the affected services in production, asked its bank to reverse the transfers and freeze the receiving accounts, filed a complaint on the National Cyber Crime Reporting Portal and began an insurance claim. The people involved had not been identified.
Keerthana Finserv (also spelled Keertana), a Hyderabad NBFC, is the second case. Local press reports say 39 unauthorised transactions moved money out of a company bank account between 11 am and noon on Friday, November 6, and that the Telangana Cyber Security Bureau registered a case. The reports disagree on the amount: Namasthe Telangana says more than Rs 7.09 crore, while Andhra Jyothy says Rs 7.9 crore. We found no company statement or exchange filing, so treat both figures as provisional.
The Week separately reports that two unnamed Mumbai NBFCs lost about $2 million through more than 700 unauthorised transfers on October 8 and 9, citing media accounts of a police complaint.
What CERT-In said about attacks on payment APIs
CERT-In is India's national computer emergency response team. An API is the software connection that lets one system give instructions to another, including a lender's system telling a bank to pay out a loan.
Its October 9 advisory, CIAD-2026-0046, rated Critical, describes criminals breaking into internet-facing applications or exposed APIs, stealing payment gateway and partner-bank API credentials, then calling fund-transfer APIs from the organization's own trusted infrastructure. That skips checks such as beneficiary verification and transaction limits. The money goes to mule accounts at several banks and is emptied quickly.
Its November 4 update, CIAD-2026-0058, also Critical, names an AI-assisted threat actor, "CRAFTY FALCON." The advisory describes:
- Entry through internet-exposed test or staging systems, then movement to production over shared credentials or network paths
- Modified copies of client apps that make unauthorized API calls
- "Micro-value test transactions (such as Rs. 1)" before larger transfers
- Attacks timed to "holidays, weekends and other low-monitoring windows"
One line deserves attention: "The same entities have been deliberately re-targeted, including after incomplete remediation." In other words, a clean-up that left something behind led to another attack. CERT-In's advice is blunt: "After any incident, assume persistence."
NBFC cyberattack: confirmed, claimed and not known
| Statement | Status |
|---|---|
| CERT-In issued Critical advisories on October 9 and November 4 | Confirmed, we read both |
| Spandana Sphoorty reported about Rs 7.80 crore sent to 82 accounts | Company disclosure. We could not open the filing itself, so details come from reports of it |
| Keerthana Finserv lost Rs 7.09 crore or Rs 7.9 crore in 39 transactions | Press reports of a police case, amount differs by outlet |
| The two thefts are connected or coordinated | Not established |
| Crafty Falcon carried out either theft | Not established. The advisory names no victims, gives no loss figures and names no country |
| How attackers got in at either company | Not disclosed |
| How much money has been recovered | No figure in anything we could read |
On timing, November 1 was a Sunday, which fits CERT-In's weekend pattern. Late morning on a Friday does not. Neither date proves anything about who was responsible.
Why this matters for any company that moves money
The advisories are addressed to Indian financial firms, but the weakness is common. Payroll, vendor payments, customer refunds and loan payouts all depend on a system holding credentials that can move money. In the attack CERT-In describes, the instruction comes from your own server with your own valid credentials, so it can look normal to the bank.
Insurance is not a quick fix either. Spandana Sphoorty says it holds cyber fraud cover and is filing a claim, but reports show no payout yet. And if your payment connections run on servers you manage, the patching and separation of those systems is your job, which is where self-hosted infrastructure needs an owner.
What to do this week to stop payment API fraud
| Check | What good looks like | Advisory |
|---|---|---|
| API inventory | Every payment API is listed, unused endpoints are switched off | 0046 |
| Credentials | No long-lived static tokens or plaintext secrets in code, secrets are in a vault and rotated | 0046 |
| Logins | MFA on payment platforms, admin portals, bank APIs and remote access | 0046 |
| Approvals | A second person approves fund movement, with per-transaction and daily caps | 0046 |
| Reconciliation | System records are matched to bank statements in near real time | 0046 |
| Logs | Central logs kept at least 180 days | 0046 |
| Test systems | Not exposed to the internet, sharing no credentials with production | 0058 |
| Fraud rules | Alerts on a tiny test payment followed by a large transfer, and on new beneficiaries | 0058 |
| Off-hours cover | 24x7 monitoring, with lower alert thresholds on weekends and holidays | 0058 |
| After an incident | Assume the attacker is still inside, verify removal forensically, rotate credentials | 0058 |
Also ask your bank what payout limits and beneficiary controls it can enforce on its side, and how fast it can freeze an outgoing transfer.
NBFC cyberattack questions people are asking
Which NBFC lost Rs 7 crore in a cyberattack?
Press reports name Keerthana Finserv in Hyderabad, on November 6, 2026, with the amount given as Rs 7.09 crore or Rs 7.9 crore. Spandana Sphoorty separately reported about Rs 7.80 crore on November 1.
What is Crafty Falcon?
It is the name CERT-In's advisory uses for an AI-assisted threat actor targeting NBFCs, fintech firms, payment companies and crypto exchanges. The public advisory does not attribute it to any country.
Are the Spandana and Keerthana attacks connected?
Not as far as anyone has said publicly. We found no official statement linking them.
Was customer data stolen?
The reports we read describe money transfers and do not say customer data was taken. They also do not rule it out.
How do attackers steal money through a payment API?
CERT-In says they steal API credentials from a compromised system, then send payout instructions from the organization's own infrastructure, skipping its normal checks.
Does this affect companies outside India?
The advisories address Indian financial firms. Any company with software connected to a bank faces the same design risk.
Where should Indian financial firms report an attack?
CERT-In asks for reports to incident@cert-in.org.in with relevant logs, and says bulk fraudulent transactions should also go to I4C through its fraud reporting portal.
The bigger lesson
The attack described here does not need to beat your bank. It only needs one forgotten test server or one token left in code, and then your own systems do the rest. The controls that stop it are ordinary ones: a second approval, a limit, and someone watching on Sunday.
To have your payment systems reviewed, see security hardening or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: CERT-In CIAD-2026-0058; CERT-In CIAD-2026-0046; The Week; The Hans India; Namasthe Telangana; Andhra Jyothy.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025....
Mirae Asset Securities Data Breach: About 39,000 People Exposed, Mostly Staff, and What Finance Firms Should Check This Week
Mirae Asset Securities says two attacks on November 4 and 5 exposed data on about 39,000 people, including 35,...
AI Regulation Compliance: California's New AI Laws, the EU's New Deadlines, and How to Prove a Human Checked the Decision
California has limited AI-only firing and created a registry for AI auditors, and the EU has moved its high-ri...
