Cyber Insurance Steps In After Spandana's Rs 7.80 Crore Fraud
Microfinance lender Spandana Sphoorty Financial has disclosed that about Rs 7.80 crore was moved from one of its bank accounts to 82 beneficiary accounts on 1 November 2026. It shut down the affected production services, sought reversal and freezes, filed a complaint on 1930 and is claiming under its cyber fraud insurance. Here is what the case means for lenders relying on cyber cover.
Microfinance lender Spandana Sphoorty Financial Limited has disclosed a cyber fraud in which about Rs 7.80 crore was moved out of one of its bank accounts in a single day, and moved quickly to contain it, with a claim under its cyber fraud insurance already being filed.
In a filing to BSE and the National Stock Exchange on 2 November 2026 under Regulation 30 of the SEBI (LODR) Regulations, 2015, the company said unauthorised transactions were debited on 1 November 2026, "in multiple transactions during the day", to 82 beneficiary accounts.
What the Company Disclosed
- Amount: approximately Rs 7.80 crore, across multiple transactions to 82 beneficiary accounts.
- Nature of fraud: "Unauthorised transactions through a cyber fraud, details under investigation."
- Immediate response: the company "immediately stopped the affected services in its production environment".
- Bank: the matter was reported to the bank, which was not named, with a request to reverse the transactions, freeze the beneficiary accounts and investigate.
- Police: a complaint was registered on the National Cyber Crime Reporting Portal (helpline 1930) on 1 November 2026; other authorities are being informed.
- Persons involved: under investigation.
- Insurance: "The Company has insurance for cyber fraud, and a claim is being filed with the insurance Company."
The filing, signed by Company Secretary Vinay Prakash Tripathi, does not say how the attackers gained access or whether any money has been recovered.
The company said it will update the exchanges as the inquiry progresses.
Why the Production Shutdown Matters
Stopping services "in its production environment" suggests the fraud ran through the company's own systems, rather than a customer falling for a scam.
The company has not confirmed the method.
It echoes a CERT-In advisory issued on 9 October 2026 (CIAD-2026-0046) warning of hijacking of payment and disbursement APIs at Indian NBFCs and fintechs.
Splitting the amount across 82 accounts in one day is also typical of mule networks built to move funds faster than banks can freeze them.
Where Cyber Insurance Helps
Spandana's quick response and existing cover show how cyber insurance can soften the balance-sheet hit from a fraud like this.
Cover works best alongside strong controls, since a claim is not a guaranteed payout.
For NBFCs and fintechs weighing or renewing cover, the incident raises practical questions:
- Know what is covered: check whether the policy covers funds transfer fraud and social engineering, not only data breaches, ransomware and business interruption, and what sub-limits apply.
- Meet the conditions: insurers typically expect controls such as multi-factor authentication, privileged-access management and logging to be in place; gaps can reduce or void a claim.
- Report fast: policies usually require prompt notice; the 1930 complaint, bank intimation and exchange filing made within a day create the paper trail a claim needs.
- Preserve evidence: keep logs, API records and forensic reports, since the insurer will want to see how the money left.
- Recovery comes first: freezing beneficiary accounts in the first hours often decides how much is lost; insurance typically pays only for what cannot be recovered, minus the deductible.
Leading Cyber Insurance Providers in India
Industry market research (Ken Research, India Cyber Insurance Market report 2026-2031) lists Tata AIG, ICICI Lombard, HDFC ERGO, Bajaj Allianz and The New India Assurance as the major players in a market it values at about USD 115 million in 2025, growing to an estimated USD 321 million by 2031.
- Tata AIG General Insurance: CyberEdge and Cyber Risk Protector policies, covering data liability, network interruption, forensics and event response.
- ICICI Lombard General Insurance: Corporate Cyber Insurance covering security and privacy breaches, ransomware, forensics and third-party liability.
- HDFC ERGO General Insurance: corporate cyber cover and the retail Cyber Sachet product.
- Bajaj Allianz General Insurance: corporate cyber, privacy liability and business interruption cover, plus personal cyber policies.
- The New India Assurance: the public-sector insurer offers commercial cyber liability and individual cyber cover.
SBI General, Go Digit, Generali Central, Liberty General and Royal Sundaram also offer cyber products.
Spandana has not named its insurer.
Lessons for Lenders
- Put velocity limits and maker-checker approval on disbursement and payout systems, especially for many transfers to new beneficiaries in one day.
- Monitor payment API keys and service accounts for use outside normal hours, locations or volumes.
- Pre-agree rapid freeze and recall procedures with partner banks.
- Test incident response, including who files with 1930, the bank, CERT-In and the exchanges, before an attack happens.