--- title: "Spandana Sphoorty: ₹7.80 crore debited to 82 accounts in a day, 26% of half-year profit" summary: "What Spandana Sphoorty’s 2 November filing says about ₹7.80 crore of unauthorised debits on 1 November, against its own half-year profit and the rules on reporting a cyber fraud." url: https://www.thetechbag.com/blog/spandana-sphoorty-7-80-crore-cyber-fraud format: Note desk: "Security" area: "Threats & vulnerabilities" region: India published: 2026-11-03 facts_checked: 2026-11-03 author: TechBag (The TechBag Journal) tags: ["Spandana Sphoorty","NBFC","microfinance","cyber fraud","unauthorised transactions","SEBI LODR","Regulation 30","RBI","DAKSH","Fraud Monitoring Return","CERT-In","1930","cyber insurance","BFSI"] cover: https://www.thetechbag.com/blog/covers/spandana-sphoorty-7-80-crore-cyber-fraud.png --- # Spandana Sphoorty: ₹7.80 crore debited to 82 accounts in a day, 26% of half-year profit *What Spandana Sphoorty’s 2 November filing says about ₹7.80 crore of unauthorised debits on 1 November, against its own half-year profit and the rules on reporting a cyber fraud.* Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-03 · Facts checked 2026-11-03 · Canonical: https://www.thetechbag.com/blog/spandana-sphoorty-7-80-crore-cyber-fraud Spandana Sphoorty Financial, a microfinance lender listed on the NSE and BSE, told the exchanges on 2 November that about ₹7.80 crore was debited from one of its bank accounts on 1 November without authorisation, in multiple transactions during the day, to 82 beneficiary accounts.[1] Three days earlier it had reported a profit after tax of ₹30 crore for the six months to September.[2] The filing calls it a “cyber fraud incident” and gives its nature as “unauthorised transactions through a cyber fraud, details under investigation”. It does not say how the transactions were made, and it names no one.[1] ₹7.80 crore debited without authorisation on 1 November, to 82 beneficiary accounts About 26% of Spandana’s profit for April to September, and 43% of the ₹18 crore it made in July to September, by our arithmetic.[2] ## What the filing says was done, and what it leaves open On finding the debits, by the company’s account:[1] - it “immediately stopped the affected services in its production environment”; - it asked the bank to reverse the transactions, freeze the beneficiary accounts and investigate; - it filed a complaint on the National Cyber Crime Reporting Portal (helpline 1930) on 1 November; - the incident “is also being reported to the other appropriate authorities”, which the filing does not name; - it has insurance for cyber fraud, and a claim is being filed. Still open: which bank, which services were stopped, whether any money has come back, and who was involved, which the annexure lists as “under investigation”. Spandana says it will tell the exchanges about recoveries and the outcome “as and when the inquiry progresses”.[1] TechBag countHow large is ₹7.80 crore for this lender? Against Spandana’s own figures for the quarter to 30 September: 26% of half-year profit after tax (₹30 crore), 43% of the quarter’s (₹18 crore), 0.57% of its ₹1,379 crore of liquidity and 0.33% of its ₹2,343 crore net worth. Spread evenly, it is ₹9.51 lakh per beneficiary account; the filing does not give the split. Before any reversal or insurance payout.[2] Our [1 November piece](https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks) rested on unnamed sources: The Economic Times put losses at small NBFCs at about ₹300 crore in two months.[7] Here a named, listed lender with assets under management of ₹5,364 crore[2] gives its own figure. Its filing does not describe the attack, and we do not link it to those reports. ## The clocks a cyber fraud starts at a listed NBFC The RBI’s cybersecurity and fraud Directions of 31 July 2026 both put their reporting duties on every NBFC above the Base Layer and on Base Layer NBFCs with assets of ₹500 crore or more.[3][5] Read together with CERT-In’s Directions and SEBI’s listing rules, a fraud like this one is reported four ways: **Figure: One cyber fraud, four sets of reports: the first are due six hours after it is found** *Reporting duties for a listed NBFC after a cyber fraud, by rule and deadline, in force on 3 November 2026* 1. 01Bank and the 1930 portalReversal and freezing requests to the bank; a complaint on the cybercrime portal. Spandana: both on 1 November. 2. 02RBI and CERT-In: 6 hoursCyber incidents to the RBI on DAKSH “within six hours of detection”, and CERT-In told; CERT-In’s own clock is 6 hours from noticing. 3. 03Exchanges: 12 or 24 hoursRegulation 30: within 12 hours if the event arises inside the company, 24 if outside. Spandana filed on 2 November. 4. 04Police, then a fraud returnFraud to the police “immediately”; a Fraud Monitoring Return to the RBI within 14 days of classifying it as fraud. Source: RBI NBFC Directions (cybersecurity; fraud risk), 31 July 2026; CERT-In Directions, 28 April 2022; SEBI LODR Regulations (amended to 22 January 2026); Spandana Sphoorty filing, 2 November 2026 · as of 3 November 2026 · Spandana's filing confirms the bank and portal reports; it does not say which other reports have been made The sources for each step: the RBI’s cybersecurity Direction, paragraphs 28 and 141, which also require the NBFC to “pro-actively notify” CERT-In;[3] CERT-In’s Directions, whose Annexure I lists “Unauthorised access of IT systems/data” and “Attacks or incident affecting Digital Payment systems”;[4] the RBI’s fraud Direction, paragraphs 40 and 43, whose list of fraud types includes “Fraudulent electronic banking / digital payment related transactions”;[5] and SEBI’s Regulation 30(6). The same rules also put “details of cyber security incidents or breaches” into each quarter’s corporate governance report, under Regulation 27(2)(ba).[6] Our viewOur view, for a lender's finance and security teams Spandana’s annexure is a template worth having ready: nature of the fraud, estimated impact, date of occurrence, persons involved, amount, and who it was reported to. Decide in advance who files on DAKSH, who calls CERT-In and who drafts the exchange filing, so the six-hour reports do not wait for the 24-hour one. How we did this Figures as of 3 November 2026, 7pm IST Incident facts are Spandana Sphoorty’s filing of 2 November and its annexure; financial figures are its Q2 FY27 press release of 30 October. The shares of profit, liquidity and net worth, and the average per account, are our arithmetic on those figures, before any recovery. Reporting duties are from the regulators’ texts as in force on 3 November. Not used: any account of how the money was moved, which the filing does not give, and the share-price move, for which we found no source we could check. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Spandana Sphoorty Financial, Intimation under Regulation 30 of SEBI (LODR) Regulations, 2015: Cyber Fraud Incident, with Annexure A (Ref SSFL/Stock Exchange/2026-27/082)](https://nsearchives.nseindia.com/corporate/SPANDANA_02112026105300_SEcyberfraud.pdf) — 2 November 2026 2. [Spandana Sphoorty Financial, press release on results for the quarter and half year ended 30 September 2026](https://nsearchives.nseindia.com/corporate/SPANDANA_30102026165427_SE_Cover_Press_release.pdf) — 30 October 2026 3. [Reserve Bank of India, (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras 28 and 141](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13592) — 31 July 2026 4. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 5. [Reserve Bank of India, (Non-Banking Financial Companies – Fraud Risk Management) Directions, 2026, paras 3, 40, 42 and 43](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13590) — 31 July 2026 6. [SEBI, (Listing Obligations and Disclosure Requirements) Regulations, 2015, amended up to 22 January 2026: regulations 27(2)(ba) and 30(6)](https://www.sebi.gov.in/sebi_data/attachdocs/jun-2026/1780915347745.pdf) — 22 January 2026 7. [The Economic Times, AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months](https://economictimes.indiatimes.com/industry/banking/finance/ai-powered-cyberattacks-siphon-300-crore-from-small-nbfcs-in-two-months/articleshow/135278215.cms) — 29 October 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Small NBFCs reportedly lost ₹300 crore in two months](https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks) — the unnamed-source reports and CERT-In advisory that came before this filing - [BFSI industry guide](https://www.thetechbag.com/industries/bfsi) — the RBI, SEBI and CERT-In obligations a lender's security stack has to meet - [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — the detection and 180-day logs behind a six-hour report