Microfinance lender Spandana Sphoorty Financial Ltd has disclosed a cyber fraud in which about ₹7.80 crore was moved out of one of its bank accounts through unauthorised transactions on 1 November 2026. In a Regulation 30 filing with the stock exchanges on 2 November, the company said the money was sent in multiple transactions during the day to 82 beneficiary accounts.
What Spandana Sphoorty has disclosed
- Amount involved: approximately ₹7.80 crore
- Date: 1 November 2026, in multiple transactions through the day
- Destination: 82 beneficiary accounts
- Nature of fraud: unauthorised transactions through a cyber fraud; details under investigation
- Persons involved: under investigation
The filing does not name the bank from which the funds were debited, and the company has not yet said how the attackers initiated the transfers or whether any money has been recovered.
How the lender responded
Spandana Sphoorty said it stopped the affected services in its production environment as soon as the fraud was identified. It has asked its bank to reverse the transactions, freeze the beneficiary accounts and carry out a detailed investigation.
The company also registered a complaint on the National Cyber Crime Reporting Portal (helpline 1930) on 1 November and is informing other authorities. It holds insurance against cyber fraud and said a claim is being filed with its insurer. Further developments, including recoveries and the outcome of the inquiry, will be disclosed to the exchanges as the investigation progresses.
Why it matters for lenders
The incident adds to a string of cyber events at Indian financial institutions in recent weeks. AU Small Finance Bank is probing a possible leak of customer data on a third-party platform, and State Bank of India has disclosed a dark-web leak involving 3,897 customer records. Cyber insurance claims from banks have already crossed an estimated ₹150 crore so far in FY27.
Smaller lenders appear especially exposed. Elets BFSI earlier reported that small NBFCs lost an estimated ₹300 crore to AI-powered cyberattacks in about two months, with CERT-In flagging payment API exploits. The Reserve Bank of India has also tightened cyber checks on banks and put fintech and NBFC API links under the scanner.
For microfinance companies, which handle high volumes of small-ticket disbursements and collections across bank accounts, the Spandana case is a reminder that controls on outgoing payments, beneficiary additions and transaction velocity matter as much as perimeter security. Quick reporting through the 1930 helpline and the bank also improves the chance of freezing funds before they are moved on.
Key takeaways
- Spandana Sphoorty lost about ₹7.80 crore to unauthorised transfers to 82 accounts on 1 November 2026.
- The lender halted affected services, sought reversal and freezing of accounts, and filed a 1930 cyber crime complaint.
- It is claiming under its cyber fraud insurance; the investigation is ongoing.
- The case follows recent cyber incidents at AU Small Finance Bank and SBI, and closer RBI scrutiny of lenders’ cyber defences.
Source: Spandana Sphoorty Financial Ltd disclosure to NSE and BSE under Regulation 30 of SEBI (LODR) Regulations, 2 November 2026.
