Recent SBI and NBFC cyber incidents, RBI’s 2026 cybersecurity directions and emerging digital banking risks highlight the need for stronger IT governance, operational resilience and professional capability-building across India’s financial sector.
India’s banking and financial services industry is increasingly dependent on digital infrastructure. Core banking systems, cloud platforms, application programming interfaces (APIs), automated lending processes, third-party technology providers and artificial intelligence now support critical financial operations.
While these technologies improve efficiency and customer accessibility, they also introduce new operational, cybersecurity, compliance and governance risks.
Two recent incidents in October 2026 have drawn attention to these vulnerabilities:
- State Bank of India (SBI): Suspected exposure of 3,897 customer records containing personally identifiable information on the dark web.
- Hyderabad-based NBFC: An alleged cyberattack involving 183 unauthorised fund disbursements totalling approximately ₹3.3 crore within 87 minutes.
These incidents highlight different risk scenarios: one involving potential loss of customer information and the other involving unauthorised financial transactions.
Neither incident’s full technical root cause had been publicly established when reported. However, both provide important lessons on technology governance, access control, digital transaction security, risk monitoring and incident response.
Against this background, the Risk Management Association of India (RMAI), through its training arm Smart Online Course, has introduced a professional training programme on IT Risk & Technology Governance in Financial Institutions: Regulatory Compliance, Technology Resilience & Enterprise Risk Management.
The programme aims to help professionals develop the knowledge required to identify, assess, govern and monitor technology risks from an enterprise-wide perspective.
1. Why IT Risk Management Has Become a Priority for Banks and NBFCs
Technology risk in banking extends beyond cyberattacks and data theft.
It includes failures or weaknesses arising from technology infrastructure, applications, systems integration, outsourcing arrangements, operational processes and governance decisions.
Key IT Risks Facing Financial Institutions
1. Cybersecurity and Information Security Risks
- Unauthorised access to customer information.
- Data leakage and misuse of privileged credentials.
- Cyber incidents affecting digital banking systems.
- Inadequate detection, escalation and response capabilities.
2. Application and API Risks
- Weak authentication and authorisation controls.
- Unauthorised transactions through connected applications.
- Failures in system interfaces and transaction validation.
- Inadequate oversight of digital lending and payment platforms.
3. Third-Party Technology Risks
- Dependence on cloud and outsourced technology providers.
- Weak vendor due diligence and contractual safeguards.
- Concentration risk involving critical service providers.
- Inadequate incident reporting and business continuity arrangements.
4. Technology Operations and Resilience Risks
- Core banking system outages.
- Failed software changes and technology migrations.
- Inadequate backup and disaster recovery arrangements.
- Single points of failure in critical technology infrastructure.
5. Emerging AI and Digital Transformation Risks
- Poor data quality and unreliable automated decisions.
- AI model performance deterioration.
- Third-party AI service dependencies.
- Weak governance over automated financial systems.
The central challenge for banks is ensuring that technology risks are governed with the same discipline as credit, market, liquidity and operational risks.
2. SBI Cyber Incident 2026: Lessons for Data Governance and Technology Risk Management
On 21 October 2026, SBI disclosed a suspected customer-data exposure involving information identified on the dark web.
According to the bank’s preliminary assessment:
- Approximately 3.75 lakh records were examined.
- 3,897 customer records containing personally identifiable information were identified.
- The exposed information reportedly included customer names, contact information, identification details and loan-related records.
- SBI stated that its core operations and business continuity had not been materially affected.
- An independent cybersecurity agency was engaged to investigate the incident.
What Can Banking Technology Risk Teams Learn?
A. Data Confidentiality and Operational Availability Are Different Risks
A bank can continue operating normally while customer information faces potential exposure.
Technology risk assessments must therefore consider confidentiality, integrity and availability separately.
B. Information Asset Governance Is Essential
Institutions should identify:
- Which systems contain sensitive customer information.
- Who owns and manages these information assets.
- Which employees and service providers can access them.
- How information is transferred between internal and external systems.
C. Access Controls Require Continuous Oversight
Banks should periodically evaluate:
- Privileged-access permissions.
- Role-based access controls.
- Monitoring of unusual data access.
- Data export restrictions.
- Third-party access arrangements.
D. Incident Response Must Include Customer Risk
Cyber incident response should address not only system recovery but also information exposure, regulatory reporting, customer protection and corrective actions.
These are general lessons derived from the reported incident. They do not establish that any particular SBI control failed.
3. Hyderabad NBFC Cyberattack: Why API Risk and Transaction Controls Matter
Another incident reported on 23 October 2026 involved an alleged cyberattack against a Hyderabad-based NBFC.
According to the complaint reported by The Times of India:
- ₹3.3 crore was allegedly siphoned from the institution.
- 183 fund disbursements were reported as unauthorised.
- Funds were transferred to 52 suspected beneficiary accounts.
- The alleged activity occurred within 87 minutes on 19 October 2026.
- Approximately ₹40 lakh was initially blocked in the suspected accounts.
The matter was under investigation by the Telangana Cyber Security Bureau.
Key Technology Governance Lessons
1. API Security Requires Transaction-Level Controls
API security should extend beyond authentication to include:
- Appropriate authorisation controls.
- Transaction and cumulative disbursement limits.
- Beneficiary validation.
- Monitoring of unusual transaction velocity.
- Emergency mechanisms to suspend compromised access.
2. Application Controls Must Be Independently Evaluated
IT risk and audit teams should assess whether application controls can prevent or detect unauthorised processing.
3. Real-Time Monitoring Is Essential
The reported 87-minute window demonstrates why high-risk financial transactions require timely risk detection and escalation.
4. Incident Response Needs Defined Accountability
Banks and NBFCs should establish clear responsibilities across technology, operations, cybersecurity, fraud management and senior management.
5. Technology Risk Must Be Integrated with Operational Risk
A weakness in digital transaction processing can create direct financial losses, regulatory exposure and reputational consequences.
The incident’s technical cause remains subject to investigation. These lessons represent control areas that financial institutions should review, not confirmed failures at the affected NBFC.
4. RBI Cybersecurity and IT Governance Directions 2026: What Financial Institutions Need to Know
On 31 July 2026, the Reserve Bank of India issued consolidated directions covering cybersecurity, technology risk, resilience and assurance for different categories of regulated financial institutions.
Two particularly relevant instruments are:
- RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, updated on 1 October 2026.
- RBI (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026.
The applicable requirements differ according to the type and regulatory classification of the institution.
These frameworks reinforce the need for structured IT governance, risk management, cybersecurity controls and independent assurance.
A. Board and Senior Management Oversight
Technology governance is not solely the responsibility of IT departments.
Banks must establish governance arrangements involving appropriate Board-level committees, senior management, technology leadership and risk management functions.
Areas requiring management attention include:
- IT strategy and alignment with business objectives.
- Technology risk appetite and accountability.
- Information security and cybersecurity governance.
- Oversight of critical technology projects.
- Periodic assessment of significant technology risks.
- Monitoring and reporting of control weaknesses.
B. IT and Information Security Risk Management
Under the commercial-bank framework, the bank’s risk management policy must incorporate IT-related and cybersecurity risks.
The framework requires periodic risk review and appropriate internal controls.
Practical implementation activities include:
- Maintaining a technology risk register.
- Identifying critical applications and information assets.
- Assessing inherent and residual technology risks.
- Establishing key risk indicators (KRIs).
- Defining risk mitigation and escalation procedures.
- Reporting material technology exposures to management.
C. Data Leakage Prevention and Access Controls
Financial institutions need appropriate safeguards for sensitive data across applications, infrastructure and outsourced environments.
Important control areas include:
- Identity and privileged-access management.
- Information asset classification.
- Data leakage prevention.
- Database and application security.
- Security logging and monitoring.
- Third-party information security controls.
D. Technology Outsourcing and Vendor Risk Management
Technology outsourcing creates dependencies that must be understood, assessed and monitored.
Governance measures include:
- Risk-based vendor due diligence.
- Evaluation of critical technology providers.
- Contractual security and audit requirements.
- Oversight of subcontracting and concentration risks.
- Monitoring of vendor performance and incidents.
- Business continuity and exit arrangements.
E. Incident Response and Technology Resilience
The commercial-bank framework requires documented cyber incident-response and recovery arrangements addressing matters such as:
- Incident classification and assessment.
- Allocation of responsibilities.
- Incident reporting and communication.
- Containment and recovery.
- Post-incident review and corrective actions.
- Testing of response plans.
The framework also includes requirements concerning cyber security operations, monitoring, investigation and coordination.
F. IT Audit and Independent Assurance
Technology controls must be evaluated for effectiveness rather than assumed to be adequate because policies exist.
Important assurance activities include:
- Risk-based IT audit planning.
- Review of IT General Controls (ITGC).
- Testing of application controls.
- Assessment of access and change-management controls.
- Monitoring of audit findings.
- Verification of corrective actions.
- Reporting to appropriate management and Board committees.
For financial institutions, regulatory readiness increasingly depends on being able to demonstrate how technology risks are identified, controlled, monitored and independently assessed.
5. IT Risk vs Cyber Risk vs Operational Risk: Understanding the Difference
Although interconnected, these risk disciplines are not identical.
| Risk category | Primary focus | Banking example |
|---|---|---|
| IT Risk | Risks arising from technology systems, processes, infrastructure and governance | Failed system implementation or unauthorised application processing |
| Cyber Risk | Risks arising from cyber threats affecting information systems and data | Customer information exposure or ransomware |
| Operational Risk | Losses resulting from inadequate or failed people, processes, systems or external events | Financial losses arising from technology or processing failures |
Cyber risk is closely related to IT risk, while technology incidents may also result in operational risk events.
The distinction matters because effective governance requires coordination among IT, Information Security, Enterprise Risk Management, Compliance and Internal Audit.
RMAI Launches IT Risk & Technology Governance Training for Financial Institutions
In view of recent banking technology incidents, growing digital dependencies and evolving RBI regulatory expectations, the Risk Management Association of India (RMAI), through Smart Online Course, has launched a new professional training programme:
IT Risk & Technology Governance in Financial Institutions: Regulatory Compliance, Technology Resilience & Enterprise Risk Management
The programme is designed to develop practical understanding of how technology is governed as an enterprise risk across strategy, operations, controls, resilience, outsourcing, compliance and assurance.
It brings together regulatory understanding, risk management principles, governance frameworks and industry-oriented examples.
Programme Curriculum: Seven Specialised Modules
Module 1: IT Risk & Technology Governance Fundamentals
Participants examine:
- Technology dependence across banking and financial institutions.
- IT risk, cyber risk and operational risk.
- Core banking systems, digital channels and infrastructure.
- Technology risk ownership and governance responsibilities.
Module 2: IT Governance Framework, Strategy & Regulatory Expectations
Key learning areas include:
- RBI technology governance expectations.
- Board and senior-management responsibilities.
- IT strategy and technology investment governance.
- IT policies, technology project oversight and management accountability.
Module 3: IT Risk Assessment, Information Assets, Controls & Risk Reporting
Participants explore:
- Technology risk identification and assessment.
- Information asset classification and ownership.
- Inherent and residual risk evaluation.
- Technology risk registers and control frameworks.
- KRIs, escalation thresholds and risk reporting.
Module 4: IT Operations, Change Management, Resilience & Business Continuity
Key topics include:
- IT service and operations management.
- Change approval and system implementation controls.
- Business Impact Analysis (BIA).
- Business Continuity Planning (BCP).
- Disaster Recovery (DR) and resilience testing.
Module 5: IT Outsourcing & Third-Party Technology Risk Management
Participants study:
- Vendor due diligence and outsourcing governance.
- Cloud and managed-service-provider risks.
- Concentration and fourth-party risk.
- Outsourcing contracts and audit rights.
- Vendor monitoring, incident management and exit planning.
Module 6: IT Audit, Compliance Monitoring & Technology Assurance
The module covers:
- Risk-based IT audit.
- IT General Controls and application controls.
- Control effectiveness assessment.
- Technology audit findings and corrective actions.
- Regulatory examination readiness and assurance reporting.
Module 7: Cloud, Digital Technology & AI Risk Governance
Participants examine emerging technology exposures involving:
- Cloud governance and technology dependencies.
- Digital banking platforms and APIs.
- System integration and FinTech partnerships.
- AI technology and model risk.
- AI lifecycle governance, monitoring and validation.
- Third-party AI risks and organisational accountability.
The programme incorporates industry examples and case studies across relevant modules to support practical understanding.
IT Risk and Technology Governance Checklist for Financial Institutions
Banks and NBFCs can begin by reviewing the following governance areas.
| Governance area | Practical assessment question |
|---|---|
| IT Governance | Are technology risk responsibilities clearly defined across management and the Board? |
| Risk Assessment | Is there an updated inventory of critical technology risks and controls? |
| Data and Access | Are sensitive information assets classified and access permissions periodically reviewed? |
| Digital Banking | Are API and application risks assessed before and after implementation? |
| Third-Party Risk | Are critical technology vendors subject to ongoing risk review? |
| Operational Resilience | Are business continuity and disaster recovery arrangements periodically tested? |
| IT Audit | Are material technology control weaknesses independently assessed and tracked? |
| Management Reporting | Are significant technology exposures and KRIs communicated effectively? |
| AI Governance | Are AI systems subject to defined ownership, validation and monitoring arrangements? |
| Professional Capability | Do employees possess the knowledge required for their technology risk responsibilities? |
This checklist is an introductory governance review tool, not a substitute for a full regulatory gap assessment.
Nominations Open: IT Risk & Technology Governance in Financial Institutions
The Risk Management Association of India (RMAI) invites nominations from banking, NBFC, insurance and financial services professionals for its newly launched programme.
The training aims to strengthen professional capability in technology governance, IT risk assessment, internal controls, digital resilience, outsourcing oversight and regulatory compliance.
Financial institutions may nominate professionals from their IT, Risk Management, Compliance, Internal Audit, Information Security and Technology Governance departments.
Register Your Interest
Submit Your Nomination for the Programme
For programme enquiries and institutional nominations:
Email: info@rmaindia.org
Strengthening Technology Governance Is Essential for Banking Resilience
The recent SBI customer-data incident and Hyderabad NBFC fund-disbursement case demonstrate the range of risks associated with increasingly interconnected digital financial systems.
While the circumstances of each incident differ, both reinforce the importance of proactive technology governance, effective controls, oversight and operational resilience.
The objective of IT risk management is not simply to prevent technology failures. It is to ensure that financial institutions understand their technology dependencies, evaluate risks, establish accountability and maintain appropriate controls over critical systems.
RMAI’s IT Risk & Technology Governance programme is intended to support that capability-building effort by equipping banking and financial services professionals with a structured understanding of technology risk from an enterprise governance perspective.
References and Further Reading
- Reuters — State Bank of India Reports Cyberattack Involving Customer Records, 21 October 2026
- The Times of India — 87-Minute Cyberattack Costs Hyderabad NBFC ₹3.3 Crore, 23 October 2026
- RBI — Commercial Banks: Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/410).
- RBI — Non-Banking Financial Companies: Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461).
- RBI — Master Direction on Outsourcing of Information Technology Services, 2023, and applicable subsequent consolidated instructions.
Regulatory information reviewed as of 23 October 2026. The article is intended for professional education and does not attribute unverified security failures to institutions involved in ongoing investigations.
