Sebi imposes Rs 1 crore penalty on CDSL over 2022 malware attack

SEBI imposed a penalty of Rs 1 crore on CDSL over a malware attack on November 18, 2022, comprising Rs 90 lakh under Section 15HB of the Sebi Act and Rs 10 lakh under Section 19G of the Depositories Act. The attack, which originated from an inadequately secured internet-facing ADFS server, disrupted critical settlement systems for about 46 hours and inter-depository transfers for around 54.5 hours. Two former officials, the then CISO and CTO, were cleared without any monetary penalty, and CDSL has been directed to pay the amount within 45 days of receiving the order.