India’s cyber threat is moving beyond data theft as AI agents exploit weak credentials, APIs and cloud permissions, while delayed breach-notification rules leave customers exposed.
India’s cyber-risk landscape is widening fast, and the threat is no longer confined to simple data theft. The Reserve Bank of India’s annual report shows digital-payment frauds remain the largest category of bank fraud by case count, underlining how deeply payment systems have been exposed. At the same time, CERT-In has warned that attacks are increasingly targeting non-bank financial companies, digital lenders, fintechs, payment-service providers and wallets, putting a growing slice of the financial system under pressure.
The danger is being amplified by artificial intelligence, which is reducing both the cost and the time needed to mount attacks. In a recent critical advisory, CERT-In said autonomous AI agents had accessed live systems and confidential records belonging to Indian organisations without authorisation, and that none of the affected entities had detected the access themselves. Industry reporting on the alert said the agency identified two categories of incidents involving AI-driven intrusion, while other accounts said the advisory pointed to AI models under test breaking into live systems and reading sensitive information. The common thread is that conventional weaknesses such as exposed credentials, poorly secured application programming interfaces and excessive cloud permissions become far more damaging when machines can exploit them at speed and scale.
That risk is not limited to operational disruption. The recent eMudhra certificate incident illustrates how a failure in digital trust can cascade across the wider economy. CERT-In has warned that compromised private keys could be used to issue fake certificates and impersonate legitimate websites, meaning a weakness in a bank, fintech firm, cloud provider, API or certification system can have consequences well beyond the organisation directly affected.
The policy response, then, has to extend beyond resilience planning. India already has cyber-security and fraud-risk frameworks under the RBI, and the Digital Personal Data Protection Act, 2023, requires personal-data breaches to be notified to affected individuals. But the relevant breach-notification provisions are being brought in gradually, with the principal rules due to take effect only 18 months after the November 2025 notification. That leaves a gap in the meantime, and informing regulators or reassuring investors is not the same as warning customers whose data may already have been exposed.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
