The National Stock Exchange (NSE) faced an unprecedented 400 million cyberattacks in a single day during ‘Operation Sindoor’, a DDoS simulation exercise. Despite the massive scale, the attack was successfully neutralized by NSE’s cyber defense teams, advanced technology, and automated backup systems, preventing any operational disruption or data compromise. The exchange’s 24/7 cybersecurity architecture, including Vulnerability Assessment and Penetration Testing (VAPT), real-time alerts, and remote backup activation (Chennai-based), ensured resilience. While no breach or financial/reputational damage occurred, the incident highlighted the potential systemic risk to financial markets due to high-volume cyber threats. NSE temporarily restricted foreign access to its website as a precaution, underscoring the interconnected vulnerabilities in global financial infrastructure. The attack, though thwarted, demonstrated the low-cost, high-impact nature of DDoS threats capable of destabilizing critical economic systems if successful.

The National Stock Exchange (NSE) faced a data security breach on its mutual fund platform, as flagged by the Federation of Independent Financial Advisors (FIFA). The breach exposed a critical flaw in client data segregation, where all clients under a main broker became visible to sub-broker partners, violating confidentiality protocols. Previously, client segregation was strictly maintained, but the new system failed to enforce this, leading to unauthorized access to investor data.Operational disruptions further compounded the issue, with transaction processing delays due to faulty integration of folio and investor identification numbers (IIN). Sub-brokers were denied login IDs, halting transactions entirely. Additional problems included restrictions on SIP/STP/redemption/switch transactions (now limited to one scheme per order), delayed SIP start dates (extended from 7 days to 1 month), and reduced validity of payment and ACH mandate links (from 48 to 24 hours).Crucially, transaction alerts and intimations—such as SIP bounces, IIN changes, approvals/rejections, and mandate updates—stopped being sent to registered distributor IDs, leaving investors and advisors uninformed about critical actions. The breach and operational failures collectively risked financial fraud, reputational damage, and loss of investor trust, though no direct evidence of data theft was reported.