INDUSTRY FACT FILE · CAPITAL MARKETS

Five New Case Studies in Capital Markets Security

Original 2026 case studies, each written as a blog post, showing how current threats play out under SEBI's CSCRF and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Trading Account That Traded Itself 3.  Case Study 2: The Algo That Went Rogue 4.  Case Study 3: Ransomware at the RTA 5.  Case Study 4: The Pledge That Was Never Authorised 6.  Case Study 5: The Cloud Bucket of KYC Records

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in securities markets with the obligations that apply in India as of October 2026—in particular SEBI's Cybersecurity and Cyber Resilience Framework, SEBI's cloud framework and CERT-In's Directions.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Entity type	Core threat	Regulatory lens	Primary bundles
1. The Trading Account That Traded Itself	Mid-size stock broker	Account takeover and circular trading	SEBI CSCRF; CERT-In	B2, B7, B10
2. The Algo That Went Rogue	Qualified RE broker	Faulty vendor algo and weak risk checks	SEBI CSCRF; exchange rules	B2, B9, B7
3. Ransomware at the RTA	Registrar and share transfer agent	Ransomware and investor data theft	SEBI CSCRF (6-hour reporting); CERT-In; DPDP	B7, B10, B8
4. The Pledge That Was Never Authorised	Depository participant	Back-office credential misuse	SEBI CSCRF; depository rules	B3, B7, B4
5. The Cloud Bucket of KYC Records	Discount broker	Public cloud storage exposing KYC data	SEBI cloud framework; CSCRF; DPDP	B3, B6, B8

A fake 'KYC update' message turned ordinary investors' accounts into tools for laundering money through illiquid stocks.

At a glance
Organisation	A Mid-size stock broker (“Broker A”) with a popular trading app
Threat	Trading account takeover used for circular trades in illiquid stocks
Why it is new	Investment-related fraud dominates cyber-fraud complaints, and CSCRF requires detection and 6-hour reporting
Codec Networks services	Trading app and authentication testing, SOC and surveillance alerts, anti-phishing (Bundles B2, B7, B10)

The scenario

Investors received messages claiming their trading accounts would be frozen unless they updated KYC through a link. The link led to a look-alike login page that captured credentials and OTPs.

Attackers logged in from new devices and used the accounts to buy illiquid stocks at inflated prices, while accounts they controlled sold the same stocks.

Investors discovered losses when they saw unfamiliar holdings; complaints and an exchange inquiry followed.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No step-up authentication for logins from new devices.
• Unusual trading patterns were not flagged for investor confirmation.
• Look-alike domains were not monitored or taken down.
• Security and surveillance alerts were not correlated.

The impact

Broker A faced investor complaints, compensation demands, an exchange inquiry and reputational damage.

The regulatory lens

• SEBI CSCRF: Mid-size REs require 24x7 SOC coverage and must report cyber incidents to SEBI within six hours.
• CSCRF audits: account security controls are examined in cyber audits performed by CERT-In empanelled auditors.
• CERT-In Directions: phishing and identity-theft incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden logins	Trading app and authentication testing; device binding review	B2
Spot the pattern	SOC and surveillance correlation of logins and trades	B7
Fight phishing	Anti-phishing, takedown and investor awareness	B10, B7

Key lessons Challenge every new device. Alert investors on unusual trades in real time. Hunt and take down look-alike sites. Correlate security and surveillance signals.

A rushed vendor update met a loose risk limit—and the order book paid the price.

At a glance
Organisation	A large broker (“Broker B”) offering algo trading to institutional and retail clients
Threat	Defective algo strategy update combined with misconfigured pre-trade risk checks
Why it is new	Programmatic trading means errors propagate in milliseconds; CSCRF and exchange rules expect strong change control
Codec Networks services	Algo and API security review, vendor assurance, real-time monitoring (Bundles B2, B9, B7)

The scenario

A vendor delivered an urgent update to an algo strategy. It was deployed after limited testing because of client pressure.

A logic flaw caused the strategy to send orders repeatedly in a loop. Pre-trade risk limits had been relaxed during a busy period and did not stop the flow.

Thousands of erroneous orders reached the exchange within minutes before kill switches were triggered.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Algo changes bypassed full testing and approval.
• Risk limits had been loosened without review.
• Vendor code was not reviewed before deployment.
• Order-rate anomalies did not alert the operations team quickly.

The impact

Broker B incurred trading losses, faced exchange action and client claims, and had to review its algo governance.

The regulatory lens

• SEBI CSCRF: secure development, change management and third-party risk management for critical systems.
• Exchange and SEBI algo trading rules: risk controls and approvals for algorithmic trading.
• Incident reporting: cyber incidents affecting systems reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control change	Secure SDLC and change-control review for algo deployments	B2
Assure the vendor	Vendor code and process review	B9
Detect anomalies	Real-time monitoring of order-rate and risk-limit changes	B7

Key lessons Never skip testing for 'urgent' algo changes. Review every change to risk limits. Review vendor code before it trades. Alert on order-rate anomalies in seconds.

The attackers chose their moment: the week before a major record date.

At a glance
Organisation	An RTA (“Registrar C”) maintaining investor records for many listed issuers
Threat	Ransomware and data theft disrupting corporate actions
Why it is new	Qualified RTAs are in CSCRF's MII category; investor-data breaches will also carry DPDP obligations
Codec Networks services	Managed SOC, ransomware simulation and recovery testing, incident response (Bundles B7, B10, B8)

The scenario

A phishing email compromised an employee's workstation. The attacker moved laterally to servers hosting investor registers.

Days before a record date for a large dividend, the attacker exfiltrated investor data and encrypted the registry systems.

Corporate-action processing stopped, issuers demanded answers and Registrar C had to report to SEBI and CERT-In within six hours.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Investor databases were not segmented from the corporate network.
• EDR alerts were not investigated promptly.
• Backups had not been restored against recovery objectives.
• The incident plan lacked issuer-communication and SEBI-reporting steps.

The impact

Registrar C faced issuer and investor complaints, regulatory scrutiny, data-breach consequences and recovery costs.

The regulatory lens

• SEBI CSCRF: MII-category controls for qualified RTAs, including 24x7 SOC, frequent cyber audits and 6-hour incident reporting to SEBI.
• CERT-In Directions: reporting within six hours and 180-day log retention.
• DPDP Act and Rules: breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR/XDR and lateral-movement use cases	B7
Prove recovery	Segmentation review, backup and recovery testing, ransomware simulation	B10
Respond and report	IR retainer, forensics and SEBI reporting support	B8

Key lessons Segment investor registers from everything else. Investigate EDR alerts in minutes. Restore backups against recovery objectives. Rehearse issuer communication and SEBI reporting.

The investors never logged in. The attacker used the DP's own back office.

At a glance
Organisation	A depository participant (“DP D”) servicing many retail demat accounts
Threat	Stolen back-office credentials used to pledge and transfer securities
Why it is new	Back-office access controls are central to protecting investor holdings; CSCRF audits examine them
Codec Networks services	Privileged-access and maker-checker testing, SOC monitoring, CSCRF audit (Bundles B3, B7, B4)

The scenario

An attacker obtained a DP D back-office user's credentials through a phishing email.

Using the back office, the attacker created pledges and off-market transfers on dormant accounts, moving securities to accounts they controlled.

Investors noticed weeks later when reviewing statements; the depository opened an inquiry.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA for back-office users.
• Pledges and transfers lacked maker-checker for dormant accounts.
• Investor alerts were delayed or not sent for some actions.
• Back-office activity was not monitored for anomalies.

The impact

DP D faced investor compensation, depository action and reputational damage.

The regulatory lens

• SEBI CSCRF: access control, monitoring and audit requirements for DPs, with cyber audits by CERT-In empanelled auditors.
• Depository rules: controls and investor communication for pledges and transfers.
• Incident reporting: within six hours to SEBI and CERT-In.

How Codec Networks would help

Need	Codec Networks response	Bundle
Lock down access	MFA and privileged-access review for back-office users	B3
Check every move	Maker-checker and alert testing for pledges and transfers	B4
Watch the back office	SOC monitoring of back-office anomalies	B7

Key lessons Enforce MFA for every back-office user. Require maker-checker on pledges and off-market transfers. Alert investors on every movement immediately. Monitor dormant accounts closely.

A storage policy changed during a migration. Millions of KYC documents became visible to anyone.

At a glance
Organisation	A fast-growing discount broker (“Broker E”) migrating KYC storage to cloud
Threat	Misconfigured cloud storage exposing investor KYC documents
Why it is new	Cloud adoption must follow SEBI's cloud framework; exposed KYC data fuels investment scams
Codec Networks services	Cloud framework assessment, posture monitoring, DPDPA programme, incident response (Bundles B3, B6, B8)

The scenario

During a migration, an engineer applied a permissive access policy to a storage bucket holding KYC images and documents.

Security researchers discovered the public bucket and alerted the broker—but some data had already appeared on a forum.

Investors began receiving targeted scam calls using their personal details.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Cloud changes were not reviewed against a secure baseline.
• No continuous monitoring for public exposure.
• KYC data was stored unencrypted and retained indefinitely.
• No rehearsed process for SEBI, CERT-In and investor communication.

The impact

Broker E faced regulatory reporting, investor harm, reputational damage and future DPDP consequences.

The regulatory lens

• SEBI cloud framework (2023): governance, data security and shared-responsibility expectations for cloud use.
• SEBI CSCRF: data security controls and 6-hour incident reporting.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Get cloud right	Assessment against SEBI's cloud framework; posture monitoring	B3
Protect KYC data	Encryption, minimisation and retention review	B6
Respond fast	IR retainer and reporting support	B8

Key lessons Review every cloud change against a baseline. Monitor storage for public exposure continuously. Encrypt and minimise KYC data. Prepare investor communication in advance.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com