The Securities and Exchange Board of India (SEBI) has imposed a penalty of ₹1 crore on Central Depository Services Limited (CDSL) over cybersecurity lapses linked to the 2022 malware attack. The regulator found that CDSL failed to maintain adequate safeguards, exposing sensitive investor data to risk. This marks one of the most significant actions taken by SEBI in recent years against a market infrastructure institution.
Background of the Malware Attack
In November 2022, CDSL reported a malware intrusion that disrupted operations and raised concerns about the safety of investor accounts. Though the company claimed that no critical data was compromised, SEBI’s investigation revealed gaps in cybersecurity preparedness and incident response mechanisms.
The regulator noted that CDSL’s systems lacked robust monitoring and failed to detect vulnerabilities in time, allowing the malware to penetrate its network.
SEBI’s Findings
SEBI concluded that CDSL had violated provisions under the SEBI Depositories Regulations and guidelines on cybersecurity issued for market infrastructure institutions. The lapses included:
Inadequate firewall and endpoint protection.
Failure to conduct timely vulnerability assessments.
Weak incident reporting protocols, which delayed corrective action.
The regulator emphasized that depositories like CDSL handle sensitive investor information and must adhere to the highest standards of security.
Penalty and Implications
The ₹1 crore penalty serves as both punishment and deterrent. SEBI stated that such lapses could undermine investor confidence in the capital markets.
CDSL has been directed to strengthen its cybersecurity framework, conduct regular audits, and ensure compliance with SEBI’s guidelines. The regulator also warned other market infrastructure institutions to treat cybersecurity as a critical priority.
Industry Reaction
The penalty has sparked discussions across the financial sector. Experts argue that the incident highlights the growing threat of cyberattacks on financial institutions and the need for continuous upgrades in security systems.
Investors, meanwhile, have expressed concern but welcomed SEBI’s strict action, seeing it as a step toward safeguarding their interests
