Breaches and incidents
Anand Rathi Share and Stock Brokers (India): SEBI fines Rs 10 lakh for cyber resilience lapses including incident reporting and API security
Exchange filing of 13 Mar 2026: a SEBI Adjudicating Officer imposed Rs 10,00,000 for violations of the Cyber Security and Cyber Resilience Framework and...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Exchange filing of 13 Mar 2026: a SEBI Adjudicating Officer imposed Rs 10,00,000 for violations of the Cyber Security and Cyber Resilience Framework and Stock Broker Regulations over 1 Apr 2023 to 31 Aug 2024, covering capacity planning, BCP and DR, password policy, data leakage prevention, PowerShell access, privileged access management, VAPT, incident reporting, API security, monitoring and detection, and client KYC validation. LiveLaw reports the order (AO Amit Kapoor, Section 15HB) found the implemented password policy did not match the documented one, DLP not demonstrated, MFA missing for certain users and VAPT of some critical assets incomplete.
- Root cause: control gaps found in a SEBI thematic inspection (6 to 10 Jan 2025), not a disclosed breach.
- Attacker: not applicable.
- Response: penalty imposed; SEBI did not hold PowerShell and file-sharing access as violations (temporarily enabled for testing) and took a lenient view on a delayed root cause analysis report after corrective steps (LiveLaw).