Spandana Sphoorty Financial Reports ₹7.80 Crore Cyber Fraud; Money Transferred to 82 Accounts

Spandana Sphoorty Financial Limited has reported a cyber fraud incident involving unauthorised transactions worth approximately ₹7.80 crore from one of its bank accounts.

The transactions took place on November 1, 2026, with funds transferred to 82 beneficiary accounts through multiple transactions.

The Hyderabad-based microfinance lender disclosed the incident to stock exchanges on Monday, November 2.

According to the company's disclosure, the affected services were stopped after the fraud was identified. The company also contacted its bank to request reversal of the transactions and freezing of the beneficiary accounts.

The development comes at a time when financial institutions across India are facing heightened cybersecurity concerns.

Just weeks earlier, the Indian Computer Emergency Response Team (CERT-In) issued a critical warning about attacks targeting payment systems and digital loan disbursement infrastructure.

Pocketly covered those developments in its October report on cyberattacks affecting Indian financial institutions.

The investigation into the Spandana Sphoorty incident is ongoing. The company has not yet confirmed how much money, if any, has been recovered.

Spandana Sphoorty Cyber Fraud: Key Details

Here are the details reported so far.

The ₹7.80 crore figure represents the estimated amount involved in the unauthorised transactions. It should not yet be treated as the company's final financial loss.

What Happened at Spandana Sphoorty Financial?

The incident reportedly involved multiple unauthorised transfers from a bank account belonging to Spandana Sphoorty Financial.

On November 1, approximately ₹7.80 crore was transferred to 82 beneficiary accounts.

The number of receiving accounts is notable because the transactions were spread across numerous destinations rather than a single beneficiary.

However, the existence of 82 beneficiary accounts does not establish that 82 individuals participated in the fraud. Identifying account ownership, tracing the money and determining who authorised the transactions are matters for the investigation.

The company has not publicly established the precise method used to carry out the transfers.

The disclosure does not confirm whether attackers obtained stolen credentials, exploited a payment interface or used another technique.

Those details will become clearer only after the investigation progresses.

According to Reuters' November 2 report, Spandana Sphoorty stopped the affected services after identifying the incident and requested assistance from the bank.

The company has also initiated the process of notifying the relevant authorities.

What Action Has Spandana Sphoorty Taken?

The company has outlined several steps taken following the discovery of the fraud.

1. Affected services stopped

Spandana Sphoorty said it immediately stopped affected services in its production environment.

This can help prevent additional suspicious transactions while technical teams investigate the incident.

The company has not specified how long the affected services will remain suspended.

2. Bank asked to reverse transactions

The lender notified the bank associated with the affected account.

It requested reversal of the unauthorised transactions, freezing of the beneficiary accounts and a detailed investigation.

Whether the transfers can be reversed depends on factors including the movement of funds and action taken by the banks involved.

3. Cybercrime complaint registered

Spandana Sphoorty registered a complaint through India's National Cyber Crime Reporting Portal on November 1.

The portal is part of the government's cybercrime reporting framework.

4. Insurance claim initiated

The company has indicated that it holds insurance coverage for cyber fraud and is sharing a claim with the insurer.

Having insurance coverage does not guarantee reimbursement of the full amount.

The final financial impact may depend on recovered funds, applicable policy conditions and the outcome of the insurer's assessment.

The company has said that further developments, including recoveries and investigation findings, will be communicated to the stock exchanges.

Why This Incident Raises Questions About Digital Lending Security

The Spandana Sphoorty cyber fraud comes less than a month after a critical cybersecurity advisory concerning India's financial sector.

On October 9, 2026, CERT-In issued advisory CIAD-2026-0046, warning financial institutions about attacks targeting payment and disbursement application programming interfaces (APIs).

The advisory identified threats affecting NBFCs, fintech companies, digital lending platforms and payment service providers.

According to CERT-In's official cybersecurity advisory, attackers in the observed campaigns used techniques that included stolen payment credentials, exploitation of exposed systems and direct invocation of fund-transfer APIs.

In certain cases, these techniques allowed unauthorised transactions to bypass ordinary application-level checks.

The advisory described fraudulent transfers routed through IMPS and NEFT systems to accounts controlled by attackers.

How such attacks can occur

Consider a digital lending company that uses a payment interface to send sanctioned loan amounts to borrowers.

Under normal conditions, a transfer should follow the required approval, verification and authorisation processes.

If an attacker gains access to sensitive payment credentials or an improperly secured interface, they may attempt to initiate transactions outside those normal controls.

CERT-In's advisory described attack patterns involving:

• Compromised payment credentials.

• Weaknesses in exposed APIs.

• Inadequate transaction verification.

• Fraudulent payment instructions.

• Transfers to mule accounts.

• Attempts to interfere with security logs.

These are general attack patterns identified by CERT-In.

There is currently no confirmed evidence that the Spandana Sphoorty incident used these particular methods or formed part of the earlier attack campaign.

That distinction is essential when examining a developing cybercrime investigation.

For additional context, read Pocketly's report on cyberattacks targeting 20 Indian financial institutions.

Were Spandana Sphoorty Customers Affected?

The publicly reported incident involves unauthorised transfers from a bank account belonging to the company.

As of November 2, the available disclosure does not establish that customers' individual bank accounts were debited.

It also does not establish that borrowers' personal information was accessed or leaked.

However, the information available is insufficient to conclusively rule out other effects.

Three questions remain unanswered:

Borrowers should avoid treating unverified social media claims as official updates.

Customers seeking account-specific information should contact the lender through its official communication channels.

Why NBFC Cybersecurity Is Becoming More Important

NBFCs have become a significant part of India's consumer lending market.

According to a TransUnion CIBIL and FIDC study, NBFCs accounted for 47% of new-to-credit consumer loan originations as of June 2026.

Pocketly examined this development in its article on NBFCs and first-time borrowers in India.

Digital lending has expanded alongside that growth.

A separate industry report showed that outstanding digital personal loans at digital-first NBFCs increased by 28% year-on-year to ₹1,54,195 crore in June 2026.

More details are available in Pocketly's analysis of digital personal loan growth in India.

As financial institutions process more transactions through digital systems, payment security and transaction monitoring become increasingly relevant.

A company may have strong customer-facing verification procedures but still need separate controls to protect internal banking and payment infrastructure.

These controls can include transaction limits, independent approval checks and continuous monitoring for unusual payment activity.

CERT-In's October advisory specifically recommended stronger authentication, beneficiary verification and near-real-time reconciliation of bank transactions.

The Spandana Sphoorty incident provides another reason for lenders to examine how unauthorised transfers are detected and contained.

What Does the Cyber Fraud Mean for Spandana Sphoorty Investors?

The timing of the incident is significant for investors following the company's financial recovery.

On October 30, 2026, Spandana Sphoorty reported a consolidated net profit of approximately ₹18 crore for the second quarter of FY2026-27.

The result represented an improvement from the ₹249 crore loss recorded in the corresponding quarter of the previous financial year.

The company had also reported a profit of approximately ₹12 crore in the preceding quarter.

These figures were reported by The Economic Times in its October 30 earnings coverage.

The latest ₹7.80 crore cyber fraud introduces an additional operational concern shortly after the earnings announcement.

However, investors should distinguish the amount involved in the fraud from the eventual accounting impact.

The company may recover part of the money through banking action or insurance, but neither outcome is confirmed.

The incident also occurred after the September quarter ended, so investors should not assume it was included in the results announced on October 30.

The main developments to watch are the amount recovered, the findings of the investigation, any additional financial disclosure and the restoration of affected services.

Investors can follow future announcements through the Spandana Sphoorty investor information page.

What Should Borrowers Learn From This Incident?

A cyber fraud involving a financial institution is different from an individual falling for a fake loan message.

Still, both situations show why borrowers need to understand who handles their financial information and how transactions are authorised.

Before applying for a loan online, verify the lender, understand the payment instructions and review the loan agreement.

The Reserve Bank of India's digital lending framework includes requirements concerning regulated lenders, customer disclosures and grievance redressal.

Pocketly explains these requirements in its guide to RBI digital lending guidelines.

Borrowers should also understand the risks of fraudulent applications impersonating legitimate lenders.

Pocketly's fake loan apps guide explains common warning signs, while its article on personal loan scams in 2026-27 covers suspicious loan offers and payment requests.

Another area worth checking is automated payments.

People using recurring payment arrangements can read Pocketly's explanation of UPI mandates and automatic payments to understand how mandates operate and why payment authorisations should be reviewed carefully.

These precautions cannot eliminate every type of cyberattack, but they can help consumers identify suspicious requests and protect their accounts.

How to Report Unauthorised Bank Transactions in India

If money disappears from your account without your permission, report the transaction immediately.

1. Contact your bank: Use its official customer-care number or mobile application. Report the unauthorised transaction and ask what protective action is required.

2. Call 1930: The government's cyber financial fraud helpline provides a channel for reporting suspected financial cybercrime.

3. File an online complaint: Visit the National Cyber Crime Reporting Portal and provide the relevant transaction information.

4. Preserve evidence: Save transaction IDs, dates, amounts, bank messages, suspicious links and relevant conversations.

5. Secure your accounts: If credentials may have been compromised, change the affected passwords and contact your bank about securing access.

6. Monitor account activity: Check for other unfamiliar transactions and keep a record of communication with the bank.

The Ministry of Home Affairs confirms that India's cyber financial fraud reporting system is intended to support rapid reporting and efforts to prevent further movement of stolen funds.

Reporting quickly can improve the possibility of intervention, although recovery is not guaranteed.

Pocketly's Approach to Responsible Digital Borrowing

For consumers applying for personal loans online, lender transparency is an essential part of choosing a financial product.

Pocketly provides a digital personal loan platform through Speel Finance Company Private Limited, an RBI-registered NBFC, as disclosed on its website.

Eligible applicants can explore personal loans ranging from ₹1,000 to ₹50,000, subject to the lender's eligibility and credit-assessment requirements.

Borrowers should check the applicable interest rate, annual percentage rate, processing charges, repayment schedule and Key Fact Statement before accepting an offer.

Pocketly's responsible lending policy describes its lending disclosures and consumer protection commitments.

Those who need short-term credit for genuine expenses can explore Pocketly personal loan options after comparing the borrowing cost and repayment obligation.

This information is provided for financial awareness and does not imply that Pocketly or its lending partner was involved in the Spandana Sphoorty incident.

What Happens Next in the Spandana Sphoorty Cyber Fraud Investigation?

Several developments remain pending.

Investigators will need to establish how the transactions were initiated, identify the people responsible and trace the funds sent to the beneficiary accounts.

Banks involved in receiving the transfers may also be asked to assist with transaction tracing and account-level action.

Spandana Sphoorty has indicated that it will provide additional information through stock-exchange disclosures as the investigation progresses.

For now, the reported figure remains approximately ₹7.80 crore across 82 beneficiary accounts.

Whether the company ultimately suffers a loss of that size will depend on the recovery process and any applicable insurance payment.

The outcome should become clearer through subsequent official disclosures.

Final Update

Spandana Sphoorty Financial's November 2026 cyber fraud disclosure leaves several questions unresolved, particularly how the transactions occurred and how much of the ₹7.80 crore can be recovered.

The company's immediate response included stopping affected services, notifying the bank, requesting reversal of transactions and registering a cybercrime complaint.

For investors, the final financial impact remains uncertain.

For borrowers, the incident reinforces the need to verify financial service providers, protect account credentials and report suspicious transactions without delay.

Pocketly will continue covering developments in Indian banking, NBFC lending, cybersecurity and consumer finance as new information becomes available.

Frequently Asked Questions

1. What happened to Spandana Sphoorty Financial?

Spandana Sphoorty Financial reported a cyber fraud incident involving unauthorised transactions from one of its bank accounts on November 1, 2026. The company disclosed the incident to stock exchanges on November 2.

2. How much money was involved in the Spandana Sphoorty cyber fraud?

Approximately ₹7.80 crore was transferred through multiple unauthorised transactions, according to the reported company disclosure.

3. How many accounts received the money?

The unauthorised transfers were reportedly directed to 82 beneficiary bank accounts.

4. Has Spandana Sphoorty recovered the stolen money?

As of November 2, 2026, the company had requested transaction reversals and account freezes, but the amount recovered had not been confirmed.

5. Was Spandana Sphoorty customer data leaked?

The available disclosure does not establish that customer information was leaked. The incident described publicly concerns unauthorised transfers from a company bank account.

6. Did Spandana Sphoorty report the incident to authorities?

Yes. The company registered a cybercrime complaint and said it was notifying other appropriate authorities.

7. What is the cyber fraud helpline number in India?

The national cyber financial fraud reporting helpline is 1930. Complaints can also be submitted through the official National Cyber Crime Reporting Portal.

8. Will the cyber fraud affect existing Spandana Sphoorty loans?

The available information does not establish any general change to existing customer loan terms, EMIs or repayment schedules. Borrowers should follow official lender communications for account-specific updates.