As per a report by MediaNama, the Economic Times reported, citing "highly placed sources," that AI-powered cyberattacks have siphoned about Rs 300 crore from smaller non-banking financial companies (NBFCs) over roughly two months, resulting in more than 150 first information reports. MediaNama says the targets were NBFCs with turnover of about Rs 1,000 crore or less, that attackers steal payment gateway and partner-bank API credentials to call disbursal APIs directly, bypassing KYC checks and transaction limits, and that they combine two Chinese AI toolkits, Artex and CyberStrike, with open-source models such as DeepSeek, Qwen, Kimi and GLM. This brief could not open the Economic Times report, so the figures rest on MediaNama's account and have not been independently confirmed.

CERT-In's critical advisory CIAD-2026-0046 of October 9, titled "Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities," says attackers compromise exposed applications and APIs and invoke disbursal or fund-transfer APIs directly from within the entities' own whitelisted infrastructure. It recommends multi-factor authentication, retiring unused APIs and long-lived static tokens, maker-checker verification and per-transaction ceilings, and it names no victims and gives no loss figures. MediaNama adds that CERT-In held a drill on October 27 with more than 300 officials from over 55 financial institutions, predominantly regional rural and cooperative banks. The RBI's Non-Banking Financial Companies (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, dated July 31, 2026, require NBFCs to report cyber incidents on the RBI's DAKSH platform within six hours of detection and to notify CERT-In. MediaNama says that neither CERT-In's advisories nor any RBI notice mentions the reported loss figures, and notes that the Central Bank of India's Rs 13.97 crore loss became public through a Hindustan Times report of a police complaint, SBI disclosed a data exposure to the stock exchanges two days after a dark web claim, and CoinDCX admitted a Rs 152 crore loss three days after dismissing breach reports.