Archive · 20 Jul 2026
SEBI Fines CDSL for 2022 Cybersecurity Lapses
SEBI, which is like the boss of the stock market in India, has fined a company called CDSL for not protecting its computers well enough.
This led to a bad virus attack in 2022 that messed up important work for almost two days.
SEBI said CDSL didn't follow the rules for keeping computers safe, like checking for weak spots and making sure only the right people could get in.
Even though SEBI warned CDSL earlier, the company didn't fix these problems.
The fine is Rs 1 crore, which is a lot of money.
CDSL has since fixed some of these issues, but SEBI still wanted to punish them to make sure other companies learn to take computer safety seriously.
SEBI fined CDSL Rs 1 crore for cybersecurity lapses that led to a malware attack in November 2022.
The attack disrupted key depository operations, including securities settlement and inter-depository transfers.
CDSL failed to classify an internet-facing ADFS server as a critical asset, leaving it vulnerable to attack.
SEBI had previously warned CDSL about these cybersecurity gaps in August 2022, but the issues were not addressed.
The malware attack infected 135 servers and 177 desktops/laptops, causing disruptions for up to 54 hours.
- Who
- Central Depository Services (India) Ltd (CDSL)
- What
- SEBI imposed a Rs 1 crore penalty on CDSL for cybersecurity lapses that led to a malware attack in November 2022.
- When
- The malware attack occurred on November 18, 2022. SEBI's order was issued on July 20, 2026.
- Where
- India
- Why
- CDSL failed to comply with several provisions of its cybersecurity framework, leading to a malware attack that disrupted key depository operations.
- Organization Fined
- Central Depository Services (India) Ltd (CDSL)
- Penalty Amount
- Rs 1 crore
- Date of Incident
- November 18, 2022
- Systems Affected
- 135 servers and 177 desktops/laptops
- Duration of Disruption
- 47 hours for key settlement systems, 54 hours for inter-depository transfers
- Regulatory Action Date
- July 20, 2026
- Critical Lapse
- Failure to classify ADFS server as critical asset
