India markets regulator penalises depository over 2022 malware attack
MUMBAI, July 20 (Reuters) - India's markets regulator on Monday imposed a fine of 10 million rupees on Central Depository Services (India) Ltd (CDSL) for multiple cybersecurity and compliance failures linked to a malware attack that disrupted depository operations in November 2022. Here are the key details
• The regulator said the Indian depository, which handles 83 million, or 70% of the country's investor accounts, had failed to classify an internet-facing server as a critical asset and to safeguard it, despite rules requiring such systems to be treated as such.
• This server was the root cause of the malware attack. By failing to secure this asset, the depository allowed cyber threats to gain access to its systems.
• SEBI also found that the depository failed to detect intrusions in real time, to properly analyse security alerts and to comply with rules for resuming trade settlement through backup sites.
• The attack disrupted critical depository functions including settlement activities, corporate actions, margin pledges and inter-depository transfers, delaying settlements scheduled for 18 November 2022, SEBI said.
• SEBI noted that the malware attack was the foreseeable outcome of accumulated cyber-security lapses, including inadequate monitoring, weak password controls and failure to implement required cyber-security safeguards.
(Reporting by Jayshree P Upadhyay; Editing by Tasim Zahid)
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
