INDUSTRY FACT FILE · CAPITAL MARKETS

Threat Landscape: Top Cyber Threats Facing Capital Market Entities

The 18 most relevant cyber threats, attacks and industry challenges for exchanges, clearing corporations, depositories, brokers, DPs and other intermediaries in India.

The rapid growth of retail investing has made the securities market a prime target for fraudsters. Reports based on Indian Cybercrime Coordination Centre (I4C) data indicate that investment frauds accounted for around 36% of cyber-fraud complaints in 2025, often using fake trading apps, impersonated brokers and social-media 'stock tip' groups.

At the same time, market infrastructure and intermediaries face ransomware, DDoS and supply-chain threats that can disrupt trading and settlement. SEBI's CSCRF requires regulated entities to detect, respond to and report such incidents within six hours.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by capital markets segment (Codec Networks assessment).

4.1 Trading account takeover and fake apps

Fraudsters phish investors with fake 'KYC update' or 'account blocked' messages, steal credentials and OTPs, and use accounts for unauthorised trades. Fake apps and impersonated brokers also lure investors into scams that damage legitimate brands.

• Questions to test: Are new-device logins and unusual trades challenged? Do investors receive alerts on every trade and transfer? Is the brand monitored for fake apps and sites?
• Relevant services: trading app and API testing, authentication review, anti-phishing and fake-app takedown, surveillance alert review.

4.2 DDoS and platform availability

Trading platforms must be available during market hours; outages on high-volume days harm investors and attract regulatory scrutiny. MIIs and Qualified REs face clarified recovery objectives for critical systems under CSCRF.

• Questions to test: Has DDoS protection been tested? Are capacity and failover validated against peak loads? Are recovery objectives tested end to end?
• Relevant services: resilience and architecture assessment, authorised availability testing, DR drill observation.

4.3 Ransomware at brokers, DPs and RTAs

Back-office and registry systems hold investor records and process corporate actions. Ransomware can halt services and expose data at critical moments such as record dates.

• Questions to test: Are investor databases segmented and backed up offline? Is EDR monitored 24x7? Has a ransomware scenario been rehearsed with the SEBI reporting step?
• Relevant services: managed SOC, ransomware simulation, backup and recovery testing, incident response.

4.4 Unauthorised transfers and back-office misuse

Compromised or misused back-office accounts at DPs and custodians can move or pledge investors' securities. Strong authentication, maker-checker and investor alerts are essential.

• Questions to test: Is MFA enforced for back-office users? Are pledges and off-market transfers subject to maker-checker? Are investors alerted immediately?
• Relevant services: privileged-access audit, maker-checker testing, SOC monitoring of back-office activity.

4.5 Third-party and supply-chain risk

Many brokers and DPs rely on common trading, back-office and cloud vendors. A single vendor compromise can affect many regulated entities at once. CSCRF expects REs to manage third-party risk.

• Questions to test: Which vendors have access to critical systems? When were their controls last assessed? Are software updates verified?
• Relevant services: third-party risk management, vendor assessments, supply-chain security testing.

• SEBI: cyber incidents reported within six hours of detection under CSCRF, with follow-up reporting and root-cause analysis.
• CERT-In: specified incidents reported within six hours; ICT logs retained for 180 days in India.
• MIIs: exchanges and depositories must be informed promptly where market operations are affected.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Audits: incidents feed into the next CSCRF cyber audit and VAPT cycle.

• Do we know our CSCRF category and the audit, VAPT and SOC obligations that come with it?
• Could we detect and report an incident to SEBI and CERT-In within six hours?
• Would we stop an unauthorised pledge or off-market transfer before it completes?
• Are fake apps or impersonators using our brand today?
• Have we tested our platforms against DDoS and our recovery objectives end to end?
• Which vendors could compromise us, and when were they last assessed?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific entity. I4C figures cover all channels and are as reported in public sources. Confirm regulatory obligations against SEBI's current circulars.