HDFC Asset Management Company (India): Morpheus...

What happened

Exchange filing of 18 May 2026: a cyber-security incident on 16 May 2026, “a communication from an anonymous source claiming access to certain portions of our IT infrastructure”; incident response activated and a specialist firm engaged. On 12 Jun the AMC emailed investors that it found “unauthorised activity” in parts of its IT systems, isolated them, and that “The individuals behind the incident have claimed to have accessed certain data”; “This incident relates to data, not to your money or your portfolio.” Investors were told to reset passwords and warned about SIM swaps (Outlook Money).
Root cause: not disclosed.
Attacker: a group calling itself Morpheus, named in the Bombay High Court proceedings; it claims more than 680 GB including investor names, addresses, PAN, bank account details, investment records, phone numbers and emails (Sansa Legal on the 29 May 2026 order). Tracker claims about this group’s methods are not confirmed for this case.
Response: reported to SEBI, CERT-In, NSE and BSE. The Bombay High Court vacation bench (Justice Shreeram Shirsat) granted an interim injunction on 29 May 2026 against publishing or trading the data and directed DoT and MeitY to block linked accounts. Shares fell about 3%.