A suspected cyber incident has put significant US stock holdings of Indian investors at risk, with Bengaluru-based fintech Stockal Securities (rebranded as Borderless in 2025) reporting unauthorized trading activity. The company disclosed that 26 accounts appeared to have been accessed using valid login credentials, with 13 of those accounts experiencing unauthorized transactions on October 15.
In the affected accounts, existing large-cap US equity holdings were reportedly sold, and the proceeds were then used to purchase thinly traded microcap securities. Investors allege that these transactions occurred without their authorization or any prior alerts, raising concerns about potential trading fraud and losses that could reportedly reach up to ₹100 crore.
Company Denies Platform Breach, Suspects Social Engineering
Stockal has vehemently denied any breach or compromise of its own platform, interface, infrastructure, or internal systems. Instead, the company suggests that the affected account holders might have fallen victim to a social engineering attack. This attack, they hypothesize, could be linked to information exposed in a data breach at another company several weeks earlier, though this connection remains unconfirmed and under active investigation.
“Our investigation has found no evidence of a breach or compromise of the Borderless platform, interface, infrastructure or internal systems,” Stockal stated. “We believe the affected account holders may have been victims of a social engineering attack involving information exposed in another company's data breach several weeks earlier.”
Investigation Underway with US Broker Partner
Stockal has engaged independent cybersecurity specialists to thoroughly examine its systems. The fintech firm is also working closely with its US-based clearing broker partner, DriveWealth, to establish the full facts surrounding the incident, review all suspicious transactions, and explore avenues for a fair resolution for affected customers.
The company confirmed that no funds were withdrawn from any accounts and that the unauthorized trading was confined to the 13 identified accounts, with no evidence of threats to the wider Borderless platform or other customer accounts. However, the critical question remains: how were multiple individual accounts accessed simultaneously if the company's platform itself was not breached? This aspect is a key focus of the ongoing investigation.
Increased Security Measures and Broader Cybersecurity Concerns
In response to the incident, Stockal has promptly implemented additional authentication and account-protection measures for its customers. This event serves as another stark reminder of the escalating cybersecurity risks in the digital financial landscape.
Recent weeks have seen other high-profile cybersecurity incidents, including a reported data leak at State Bank of India and a significant hack at cryptocurrency exchange Binance. As digital transactions become more prevalent and individuals' digital footprints expand, the need for robust safeguards and vigilance against sophisticated cyber threats continues to grow.