Global Markets
Home›Global Markets›Trade & Tariffs›CDSL shares fall after SEBI imposes ₹1 crore cybersecu…
CDSL shares fall after SEBI imposes ₹1 crore cybersecurity penalty
SEBI ordered Central Depository Services (India) Ltd to pay the ₹1 crore within 45 days after a 2022 malware attack disrupted settlement and pay-in/pay-out systems.
CDSL shares traded lower on Tuesday after India’s markets regulator, SEBI, imposed a ₹1 crore penalty on Central Depository Services (India) Ltd for cybersecurity lapses. LiveMint reported the stock fell as much as 0.9% to ₹1,372.10 on the NSE, and was down 0.6% at ₹1,376.70 at 10:30 AM.
SEBI’s action follows a malware attack on November 18, 2022, which disrupted several critical systems at the depository. The regulator said the company failed to treat an internet-facing Active Directory Federation Services server as a critical asset, excluded it from vulnerability assessment and penetration testing, and did not implement baseline cybersecurity controls despite regulatory requirements flagged in August 2022.
SEBI also noted that attackers had gained access to CDSL servers as early as November 2021, nearly a year before the malware attack was detected. According to the order, the malware infected 135 of 547 servers and 177 of 506 desktops and laptops, disrupting key depository operations including settlement, pay-in/pay-out, and pledge-related activities on November 18, 2022.
CDSL said there would be no material impact on its financials, operations, or other activities aside from payment of the proposed penalty amount. SEBI directed CDSL to pay the penalty within 45 days, and the regulator imposed ₹90 lakh under the SEBI Act and ₹10 lakh under the Depositories Act.