Cybercriminals have allegedly stolen nearly Rs 300 crore from small NBFCs in India over 18 months, using Chinese AI tools.
How Are Small NBFCs Being Targeted?
Small non-banking financial companies (NBFCs) across India are facing increasing cyberattacks, with fraudsters allegedly stealing approximately Rs 300 crore over the past 18 months. Around 150 complaints and FIRs have been registered in connection with these incidents.
The attacks have reportedly intensified over the past one-and-a-half months, raising concerns about cybersecurity weaknesses among smaller financial institutions. Investigations suggest that Chinese AI tools may have been used in some of these attacks.
Why Are Smaller NBFCs Vulnerable?
Financial institutions with turnover below Rs 1,000 crore have reportedly become frequent targets because their cybersecurity arrangements are often less developed than those of larger organisations.
As of October 15, approximately 8,502 NBFCs were registered with the Reserve Bank of India. The highest number of complaints came from Mumbai, with around 30 cases, followed by Delhi with more than 25 and Chennai with approximately 15 to 16. These figures indicate that the reported incidents extend across several major financial centres.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Which AI Tools Are Allegedly Involved?
Cybersecurity agencies investigating the incidents have identified suspected links to Chinese hacking platforms such as CyberStrike and ARTEX. Investigators have also reported the use of Chinese open-source AI models, including DeepSeek, Qwen, Kimi and GLM.
According to the findings, the attacks have targeted financial systems not only in India but also in Japan and South Korea. However, the available information does not establish the precise role of each AI tool in individual incidents.
What Security Weaknesses Have Emerged?
An official cited in the findings said smaller NBFCs often lack sufficient knowledge about appropriate cybersecurity arrangements and the frequency of security audits. Such weaknesses can leave their systems exposed to attackers.
The official further explained that cybercriminals may spend 10 to 12 days studying an institution before launching an attack. During this period, they reportedly examine payment processes, uploaded identification documents and coding vulnerabilities.
The incidents underline the importance of cybersecurity assessments, regular audits and stronger protection of financial systems, particularly among smaller lending institutions that may have limited security resources.
