Capillary Technologies India Limited has disclosed that a recently acquired overseas step-down subsidiary was targeted in a cyber-enabled banking fraud involving approximately €3 million in unauthorized fund transfers. The Bengaluru-headquartered enterprise software company said the incident involved sophisticated impersonation techniques, including voice cloning, forged signatures, and social engineering methods designed to mimic senior company executives. The disclosure was filed with the BSE and National Stock Exchange of India on July 6, 2026, as the company continues recovery efforts and assesses the potential financial impact.
Details of the Incident
According to Capillary Technologies, the fraudulent transfers were made to unauthorized third-party bank accounts after perpetrators impersonated key managerial personnel. The company described the attack as a highly advanced deepfake-enabled fraud, suggesting that criminals used multiple forms of deception to bypass internal controls and persuade relevant parties to approve the transactions. The incident occurred shortly before the weekend, prompting the company and its subsidiary to prioritize urgent actions aimed at protecting funds and maximizing the likelihood of recovery.
Recovery and Investigation
Capillary Technologies said it acted immediately after identifying the matter and has already recovered €0.45 million of the transferred amount. The company added that further funds were traced with assistance from local authorities, while the relevant bank accounts have since been placed on hold by the respective financial institutions. However, the exact value of the funds currently frozen remains undetermined, and the investigation is continuing with banks, cybercrime authorities, law-enforcement agencies, and other stakeholders.
Insurance and Financial Exposure
The affected subsidiary is covered by a cyber and crime insurance policy, and Capillary Technologies has notified its insurer about the fraud. The company is evaluating the scope of insurance coverage, the recoverability of the transferred money, and the resulting net financial exposure, which it said cannot yet be calculated with certainty. While the gross amount involved stands at roughly €3 million, the final financial impact will depend on the recovery process, the value of frozen funds, and the extent to which insurance proceeds may offset losses.
Data Protection and Business Continuity
Capillary Technologies stated that it currently has no evidence of a compromise involving customer data, employee information, or the company’s technology infrastructure. It also said that business operations have continued without material disruption, indicating that the incident was limited to fraudulent banking activity rather than a broader systems breach. Based on the information available so far, the company does not expect the matter to require changes to its annual objectives or longer-term strategic plans.
Disclosure Timing and Regulatory Context
The company acknowledged that the disclosure to stock exchanges was delayed because it first focused on taking immediate and time-sensitive steps to secure funds and coordinate with relevant institutions. Capillary Technologies said it required additional time to establish the material facts surrounding the incident before making a formal disclosure under Regulation 30 of the SEBI Listing Obligations and Disclosure Requirements Regulations. The company has sought the forbearance of the exchanges for the delay and said it will provide further updates should material developments arise.
The incident highlights the growing operational threat posed by AI-enabled impersonation techniques, particularly where voice cloning, fabricated documents, and targeted social engineering can be combined to authorize fraudulent financial transfers. Capillary Technologies has recovered part of the funds and secured holds on additional accounts, but the ultimate loss remains unresolved pending investigation, recovery efforts, and insurance assessments. The company’s disclosure indicates that core operations and data systems remain unaffected, although the case underscores the need for stronger verification processes around high-value payments and executive communications.