Spandana Sphoorty: ₹7.80 crore debited to 82 accounts in a day, 26% of half-year profit

01What the filing says was done, and what it leaves open

On finding the debits, by the company’s account:¹

• it “immediately stopped the affected services in its production environment”;
• it asked the bank to reverse the transactions, freeze the beneficiary accounts and investigate;
• it filed a complaint on the National Cyber Crime Reporting Portal (helpline 1930) on 1 November;
• the incident “is also being reported to the other appropriate authorities”, which the filing does not name;
• it has insurance for cyber fraud, and a claim is being filed.

Still open: which bank, which services were stopped, whether any money has come back, and who was involved, which the annexure lists as “under investigation”. Spandana says it will tell the exchanges about recoveries and the outcome “as and when the inquiry progresses”.¹

Our 1 November piece rested on unnamed sources: The Economic Times put losses at small NBFCs at about ₹300 crore in two months.⁷ Here a named, listed lender with assets under management of ₹5,364 crore² gives its own figure. Its filing does not describe the attack, and we do not link it to those reports.

02The clocks a cyber fraud starts at a listed NBFC

The RBI’s cybersecurity and fraud Directions of 31 July 2026 both put their reporting duties on every NBFC above the Base Layer and on Base Layer NBFCs with assets of ₹500 crore or more.³⁵ Read together with CERT-In’s Directions and SEBI’s listing rules, a fraud like this one is reported four ways:

The sources for each step: the RBI’s cybersecurity Direction, paragraphs 28 and 141, which also require the NBFC to “pro-actively notify” CERT-In;³ CERT-In’s Directions, whose Annexure I lists “Unauthorised access of IT systems/data” and “Attacks or incident affecting Digital Payment systems”;⁴ the RBI’s fraud Direction, paragraphs 40 and 43, whose list of fraud types includes “Fraudulent electronic banking / digital payment related transactions”;⁵ and SEBI’s Regulation 30(6). The same rules also put “details of cyber security incidents or breaches” into each quarter’s corporate governance report, under Regulation 27(2)(ba).⁶