Archive · 20 Jul 2026
SEBI Penalizes CDSL for Cybersecurity Failures
SEBI, which is like the boss of the stock market in India, has fined CDSL, a company that helps people keep their stocks safe, 1 crore rupees.
This is because CDSL didn't protect its computers well enough.
A bad person got into their computers a year ago and stayed there for a whole year before anyone noticed.
SEBI says CDSL made some big mistakes, like making a password that never expires and not locking the account after too many wrong tries.
So, SEBI is saying, 'You need to do better to keep people's stocks safe!'
SEBI has penalized CDSL with a fine of Rs 1 crore for failures in cybersecurity measures.
The attacker gained access to CDSL's servers in November 2021 and the attack was discovered in November 2022.
CDSL created an admin account in 2021 with a password set to never expire.
The relaxation regarding the lockout threshold to three failed attempts was not addressed until the malware attack.
SEBI argues that these failures led to a significant data breach and compromised cybersecurity.
- Who
- SEBI (Securities and Exchange Board of India) and CDSL (Central Depository Services Limited)
- What
- SEBI has penalized CDSL for failures in cybersecurity measures.
- When
- The attack was discovered in November 2022, with initial access in November 2021.
- Where
- India
- Why
- Due to inadequate cybersecurity measures that allowed a malware attack to occur and go undetected for a year.
SEBI
CDSL
Cybersecurity Measures
SEBI
SEBI argues that CDSL failed to implement adequate cybersecurity measures, leading to a significant data breach.
CDSL
CDSL may argue that they took necessary steps and that the breach was an isolated incident.
- Penalty Amount
- Rs 1 Crore
- Attack Discovery Date
- November 2022
- Initial Access Date
- November 2021
- Admin Account Password
- Set to never expire
- Lockout Threshold
- Three failed attempts