India’s cybersecurity landscape faces growing challenges as financial data exposure, compromised digital certificates, AI-assisted cyberattacks and online impersonation scams highlight vulnerabilities across interconnected systems. A cybercrime briefing compiled by the Centre for Police Technology (CPT) in association with Algoritha Security brings together ten developments spanning banking, law enforcement, national security and global technology infrastructure.
The cases highlight different risks, from the protection of customer records to the misuse of artificial intelligence and suspected cross-border criminal activity. Several investigations remain ongoing, making it important to distinguish reported allegations from confirmed findings.
1. SBI Investigates Customer Data Exposure After Records Surface on Dark Web
State Bank of India (SBI) disclosed on October 21 that customer information had been identified in a larger collection of data reportedly circulating on the dark web.
According to the bank’s preliminary analysis, 3,897 records containing personally identifiable information were identified within a dataset of approximately 375,000 records. The information reportedly included names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan-related details.
SBI said it received alerts from its threat-intelligence provider, the Defence Cyber Agency and CERT-In. It activated incident-response procedures and engaged an independent CERT-In-empanelled cybersecurity agency to investigate the source and extent of the exposure.
The bank stated that its core operations, financial performance and business continuity had not been materially affected.
Important distinction: The larger dataset should not be described as 375,000 confirmed affected SBI customers. The origin and authenticity of the records, along with the full scope of the exposure, remain under investigation.
The incident reinforces the importance of customer-data protection, third-party security and timely incident response across the banking sector.
2. CERT-In Warns of Compromised eMudhra Digital Certificates
CERT-In issued an advisory on October 21 concerning eight compromised intermediate certification-authority certificates associated with eMudhra’s international public-trust infrastructure.
Six certificates were associated with Transport Layer Security (TLS), while two were related to code signing. According to the advisory described in the report, the affected private keys were generated with insufficient cryptographic randomness, making them recoverable from their corresponding public keys.
Misuse could potentially allow fraudulent website certificates, impersonation, interception attacks or malicious software to appear trusted.
eMudhra revoked the affected intermediate certificates, while Google and Mozilla implemented measures to distrust or block them. Google also outlined further root-store changes.
The report stated that India's regulated Digital Signature Certificate and eSign services were unaffected. It also noted that public disclosures available at the time had not established confirmed malicious exploitation of the compromised keys.
The incident highlights the importance of cryptographic key management, certificate inventories and regular validation of digital trust infrastructure.
3. Defence Ministry Signs ₹770-Crore Anti-Drone Radar Contract
The Ministry of Defence signed a contract worth approximately ₹770 crore with Bharat Electronics Limited (BEL) on October 21 to procure Improved Low Level Light Weight Radars for the Indian Army.
According to the official announcement cited in the report, the systems can detect and track fighter-sized aircraft as well as mini and micro drones. They also provide target-prioritisation capabilities to support air-defence operations.
The radar platform incorporates software-defined capabilities, pulse-Doppler technology, active electronically scanned array technology and advanced signal processing.
The contract represents a procurement agreement; it does not establish that all systems have already been delivered or deployed. The development nevertheless underscores the importance of low-altitude surveillance as unmanned aerial systems become increasingly relevant to security operations.
4. UP Police Arrests Company CEO in Alleged ₹250-Crore Financial Fraud
The Economic Offences Wing of Uttar Pradesh Police arrested Madhumita Kaur, director and chief executive of B Care Company, in Ranchi, Jharkhand, according to the report.
The investigation concerns alleged irregularities involving insurance policies and investment schemes valued at approximately ₹250 crore. Police reportedly said that 26 cases had been registered across Uttar Pradesh, Jharkhand, Uttarakhand and Bihar against the accused and other individuals associated with the company.
The allegations concern financial promises linked to insurance premiums and investment arrangements. Investigators obtained transit remand to bring Kaur to Lucknow for further proceedings.
The ₹250-crore figure represents the reported scale of the schemes under investigation, not a judicially established fraud loss or confirmed recoverable amount.
The case illustrates the importance of examining insurance policies, premium transactions, customer records and beneficiary accounts when investigating complex financial allegations.
5. Bengaluru Police Arrests Suspect Over Fabricated AI Explosion Video
Bengaluru Police arrested a 25-year-old man on October 21 for allegedly creating and circulating an AI-generated video depicting an explosion at Vidhana Soudha, Karnataka’s legislative complex.
Police identified the accused as Hazarat Ali, a migrant worker from Bihar’s Araria district. According to the report, the video showed the building followed by synthetic visual effects portraying a large explosion. It was circulated on Instagram with a caption claiming that the legislative assembly had been bombed.
Police reportedly detected the content through digital monitoring, registered a case and traced the associated account using technical evidence.
Investigators are examining the accused’s motive and whether other people were involved in creating or distributing the video.
The explosion depicted in the video was fabricated; the report does not describe an actual bombing. The incident demonstrates how synthetic media can spread misinformation and potentially cause public alarm.
6. Haryana Approves 204 Additional Cybercrime Coordination Posts
Haryana has approved 204 additional posts for the Haryana Cyber Crime Coordination Centre, according to a statement by state Director General of Police Ajay Singhal reported on October 22.
The announcement was made during Police Commemoration Day activities in Panchkula. The DGP also reported that cybercrime complaints declined by approximately 17% during September 2026 and that nearly 40% of defrauded funds had been frozen or recovered.
The distinction between frozen and recovered funds is important: money frozen in an account is not necessarily money already refunded to victims. Similarly, the reported decline in complaints requires consistent comparisons across reporting periods before broader conclusions can be drawn.
The staffing expansion is intended to strengthen the state's capacity to investigate technology-enabled crime and respond to financial fraud.
7. Jammu Police Recover Narcotics in Suspected Drone-Smuggling Case
Jammu Police reportedly recovered 804 grams of heroin and approximately 1.114 kilograms of opium from the Arnia sector near the India–Pakistan International Border.
According to the report, the investigation began on October 20 following information about suspected narcotics activity involving a local resident. Subsequent questioning and investigative leads reportedly pointed to a possible connection with a drone-delivered consignment.
The narcotics were recovered from the Talhar area of Arnia. Police are investigating the suspected supply chain, the intended recipients and possible associates under relevant provisions of the Narcotic Drugs and Psychotropic Substances Act.
The alleged drone-delivery mechanism and cross-border connections remain preliminary investigative findings. The complete network has not yet been established.
8. Retired Police Officer Allegedly Loses ₹71 Lakh in Digital-Arrest Scam
Nashik Cyber Police are investigating a case in which a 68-year-old retired assistant sub-inspector allegedly lost ₹71 lakh to fraudsters impersonating officials of the Anti-Terrorism Squad and National Investigation Agency.
According to the complaint, the callers falsely claimed that the victim’s Aadhaar card had been recovered from a terrorist arrested in Kashmir. They allegedly connected his identity to a bank account involved in laundering ₹70 crore and used calls and messages to intimidate him.
The reported transfers were:
October 5: ₹41 lakh
October 8: ₹25 lakh
October 13: ₹5 lakh
The total reported loss was ₹71 lakh. The victim filed a police complaint on October 17, and investigators are examining beneficiary accounts and communications, including WhatsApp and Signal messages.
The supplied report did not confirm an arrest or recovery. The case highlights how criminals can exploit fear and impersonate law-enforcement agencies to pressure victims into transferring money.
9. Microsoft Reports AI-Assisted Cyber Campaign Targeting Cloud Systems
Microsoft published threat-intelligence findings on October 21 concerning an AI-assisted cyber campaign attributed to the China-state-aligned threat group Storm-0940.
According to Microsoft, the group used an agentic AI penetration-testing framework called ARTEX to automate attacks against organisations worldwide. The company also linked the group to a supply-chain compromise involving ConnectWise Cloud Backup applications.
Attackers allegedly used compromised application credentials to attempt access to downstream Microsoft 365 environments.
Microsoft reported more than 2,250 downstream tenant authentication attempts and activity reaching approximately 2,900 authentication attempts per minute. Some successful intrusions reportedly progressed to privileged cloud access in less than three hours.
However, successful authentication does not necessarily establish that customer data was accessed or stolen. The attribution to Storm-0940 reflects Microsoft's threat-intelligence assessment rather than an independently established legal finding.
The report highlights the need for organisations to review cloud application permissions, monitor service identities, rotate compromised credentials and improve third-party security oversight.
10. PHP Vulnerabilities Trigger Precautionary Website Shutdowns in Europe
Organisations across Europe temporarily disabled websites on October 21 following warnings about two critical vulnerabilities affecting PHP-based systems, according to the supplied report.
Reportedly affected services included government websites, hospital websites and the Port of Rotterdam, with precautionary shutdowns in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic. The Wikimedia Foundation also temporarily disabled some systems while applying security updates.
PHP developers released fixes, and cybersecurity authorities advised organisations unable to patch promptly to consider temporarily disabling affected systems.
A precautionary shutdown does not prove that a website was successfully compromised. The report noted that exploitation had not been confirmed for some affected systems, although emerging attack activity was also reported.
The incident carries implications for Indian organisations using PHP-based government portals, healthcare systems, education platforms and business websites. Maintaining software inventories, applying security patches and validating recovery procedures are essential elements of operational resilience.
Strategic Assessment: Four Major Cybersecurity Priorities
The ten developments point to four broad priorities for institutions in India.
1. Protect digital trust and customer data. The SBI exposure and eMudhra certificate incident underline the need for strong data protection, cryptographic key management, certificate monitoring and third-party security reviews.
2. Prepare for AI-assisted cyberattacks. Automated reconnaissance and rapid cloud exploitation require continuous monitoring, least-privilege access and faster incident containment, alongside appropriate human oversight.
3. Integrate financial investigation with digital forensics. The alleged investment fraud and digital-arrest scam demonstrate why transaction trails, beneficiary accounts, communications and forensic evidence must be examined together.
4. Strengthen technology-enabled national security. Anti-drone radar procurement and the suspected drone-smuggling case highlight the growing role of surveillance technology, electronic intelligence and coordinated investigations.
For organisations reviewing financial controls and suspicious transactions, financial investigation services may be relevant to examining records and identifying financial irregularities.
Priority Actions for Police, Banks and Cybersecurity Teams
Priority area | Recommended action |
|---|---|
Banking cybersecurity | Review data exposure, third-party access and incident-response readiness. |
Digital certificates | Audit certificate chains, key generation and trust-store dependencies. |
AI-assisted threats | Monitor cloud identities, application permissions and unusual authentication activity. |
Financial fraud | Connect transaction analysis, beneficiary records and digital evidence. |
Cyber policing | Improve synthetic-media analysis and digital-evidence preservation. |
Critical infrastructure | Identify vulnerable software, patch promptly and test recovery plans. |
National security | Strengthen counter-drone surveillance and technology-enabled investigations. |
Conclusion
The developments reported on October 22 show that cybersecurity extends beyond protecting individual computers or networks. It increasingly involves safeguarding financial records, digital identities, cloud services, cryptographic infrastructure and national-security systems.
For India, an effective response will require stronger preventive controls, coordinated cyber policing, reliable forensic processes and rapid information-sharing between institutions. As AI-enabled threats and digital fraud evolve, preparedness and evidence-led investigation will remain essential.