Rs 300 Crore Reported Stolen From Small NBFCs, and CERT-In's Two Advisories Name No Victim, Tool or Loss

An attacker holding a lender's stolen payment-gateway or partner-bank API credentials can call its disbursal endpoints directly, skipping KYC checks and per-transaction limits, according to a CERT-In advisory issued on October 9, 2026. The Economic Times reported that this method has taken about Rs 300 crore from smaller non-banking financial companies (NBFCs) in roughly two months. No regulator has confirmed that figure.

The Economic Times report, as summarised by MediaNama on October 30, puts the complaint count above 150 first information reports, and says most targets had turnover of about Rs 1,000 crore or less. One Delhi-based NBFC reportedly lost Rs 7.5 crore in one attack and Rs 7.25 crore a few days later. MediaNama writes that its own questions to the regulators cite "nearly 150 complaints", so the count differs slightly between the two outlets.

What the advisories say and leave out

CERT-In, which sits under the Ministry of Electronics and Information Technology, has published two Critical-rated advisories this month. The Daily Pioneer's report numbers the first CIAD-2026-0046 and says it covers NBFCs, digital lenders, fintech firms and wallet operators. The second, issued on October 15, describes "a financially motivated campaign against Indian entities" using free, publicly available AI-native offensive-security frameworks.

By MediaNama's reading, neither advisory names an affected company, a threat actor, an incident count or a loss amount. The Economic Times attributes two toolkits to the activity, Artex and CyberStrike, and says completed investigations traced some cases to CyberStrike, a Chinese hacking platform. It also reports that experts believe the attackers pair those kits with open models including DeepSeek, Qwen, Kimi and GLM. CERT-In's public notices name none of this.

Date	Source	What it states
Oct. 9	CERT-In, CIAD-2026-0046	Stolen gateway and partner-bank API credentials reach disbursal APIs; names no entity or loss
Oct. 15	CERT-In advisory	Criminals using public AI offensive frameworks; affected organisations could not detect access on their own
Oct. 27	CERT-In drill	More than 300 officials from over 55 financial institutions; no mention of NBFCs or losses

The disclosure gap

MediaNama's argument is that the public learned of the NBFC losses from a newspaper. It lists three earlier cases that surfaced the same way. A Rs 13.97 crore loss at Central Bank of India became public through a Hindustan Times report on its police complaint. SBI told the stock exchanges on October 21 about a data exposure, two days after a report that a threat actor claimed to hold the data. CoinDCX's chief executive called breach reports a false alarm on October 22 and confirmed a Rs 152 crore loss three days later.

The reporting clocks are not in doubt, MediaNama notes. CERT-In's 2022 directions require incidents to be reported within six hours of noticing them. The Reserve Bank of India's July 2026 directions give NBFCs six hours through its DAKSH platform. Under the Digital Personal Data Protection Act, the Data Protection Board must hear within 72 hours, but Rule 7 of the DPDP Rules 2025 takes effect only on May 13, 2027.

That last date matters for this story. CERT-In describes theft of funds through payment APIs, and it is unclear whether personal data was exposed at all, so the DPDP duty to notify customers may not apply even once it is live.

What is not established

The Rs 300 crore figure and the 150-plus complaint count rest on one outlet's reporting. The Terminal could not retrieve the Economic Times article itself and relies on MediaNama's account of it. The attribution to Artex and CyberStrike is the same: CERT-In reportedly advised NBFCs to prioritise alerts linked to the two names, but its public notices do not carry them.

MediaNama wrote to the RBI, SEBI, CERT-In and CSIRT-Fin and said responses were pending at publication. Its questions include whether the RBI confirms the Rs 300 crore, and whether CERT-In will publish aggregate incident counts.

Other recent theft stories on this site include Binance's $6.3 billion loss and 25 rooted PAN-OS firewalls. For lenders, the practical step that follows from the October 9 advisory's description is to rotate gateway and partner-bank API credentials and review disbursal-API logs for calls that skipped KYC. MediaNama said it will update its article when the regulators respond.