CDSL share price traded lower on Tuesday after the Securities and Exchange Board of India (SEBI) imposed a total penalty of ₹1 crore on Central Depository Services (India) Ltd (CDSL) for cybersecurity lapses linked to a malware attack in November 2022. CDSL shares declined as much as 0.94% to ₹1,372.10 apiece on the NSE during the session.
At 10:30 AM, CDSL share price was trading 0.61% lower at ₹1,376.70 per share on the NSE.
SEBI Imposes ₹1 Crore Penalty on CDSL
SEBI imposed a penalty of ₹90 lakh under the SEBI Act and ₹10 lakh under the Depositories Act for failing to comply with cybersecurity and cyber resilience requirements. The regulator directed CDSL to pay the penalty within 45 days.
The action followed SEBI’s investigation into the malware attack on November 18, 2022, which disrupted several critical systems of the depository. The regulator also dropped adjudication proceedings against CDSL’s former Chief Information Security Officer (CISO) Rajesh Nadkarni and former Chief Technology Officer (CTO) Amit Mahajan without imposing any monetary penalty, stating that the alleged lapses could not be individually attributed to them.
Cybersecurity Lapses Identified by SEBI
In its 88-page order, SEBI stated that CDSL failed to classify its internet-facing Active Directory Federation Services (ADFS) server as a critical asset. The server was excluded from vulnerability assessment and penetration testing (VAPT) and was not integrated with Security Information and Event Management (SIEM) and Privileged Identity Management (PIM) systems.
SEBI noted that the deficiencies were flagged to CDSL in August 2022, but the company did not address them and relied on an earlier deficient VAPT exercise.
The regulator highlighted that attackers gained access to CDSL’s servers as early as November 2021, almost one year before the malware attack was detected in November 2022.
SEBI stated that the ADFS server had weak security controls, including a privileged administrator account with a weak password that could be easily brute-forced. The password was set to “Never Expire”, while two-factor authentication was not implemented. The absence of SIEM integration also prevented effective monitoring of suspicious activities.
Malware Attack Impacted Critical Operations
According to SEBI’s order, the malware attack affected 135 out of 547 servers and 177 out of 506 desktops and laptops. The incident disrupted key depository operations, including settlement, pay-in/pay-out and pledge-related activities.
CDSL isolated its systems after detecting the attack and restored services over the following two days. However, SEBI noted that settlement activities remained disrupted for nearly 46 hours, while inter-depository transfers were affected for 54.5 hours, impacting participants across the securities market.
The regulator also stated that CDSL failed to declare a disaster within the prescribed timeline and did not restore critical systems within the recovery time objective mandated by SEBI.
CDSL Says No Material Financial Impact
CDSL stated that there was no material impact on its financials, operations or other activities, except for the payment of the proposed penalty amount.
SEBI considered the corrective measures taken by CDSL after the incident, along with an earlier financial disincentive of ₹10 lakh imposed under its cyber incident reporting framework, while determining the penalty.
CDSL Share Price Performance
CDSL share price has gained 1% in the last three months but has declined 5% on a year-to-date (YTD) basis. The stock has fallen over 20% in the last one year. However, CDSL shares have delivered multibagger returns of 132% over the past three years.
