HDFC AMC Cybersecurity Breach: Investors Warned to Reset Passwords and Be Cautious of SIM-Swap Attacks

HDFC Asset Management Company has warned investors to reset their passwords and be cautious of SIM-swap attempts following a cybersecurity breach that compromised parts of its IT systems. The company manages approximately ₹7.6 lakh crore in assets, making it India’s second-largest AMC by AUM.

Cybersecurity Breach at HDFC AMC

The incident originated on 16 May 2026, when the company received a communication from an anonymous source claiming access to portions of its IT infrastructure. HDFC AMC activated its internal containment and incident response protocols and engaged a specialist firm to assess the extent of the potential impact.

The company has reported the breach across the full spectrum of financial regulators and obtained judicial protection over the affected data. “We have reported the matter to the relevant authorities, including SEBI, CERT-In, the NSE and the BSE. We have also obtained an order from the Hon’ble Bombay High Court restraining anyone from publishing, circulating, or misusing the affected data. Our systems have been secured and our investigation is ongoing,” the company told investors.

Impact on Mutual Fund Investments

Mutual fund units and portfolio values remain unaffected, the company has confirmed, but investor identity and financial data may have been exposed. A standard HDFC AMC folio record contains a combination of PAN, bank account details, address, investment history, SIP amounts, and nominee information.

Market Impact and Details

• HDFC AMC has been explicit on this point: “Your investments, units, and the value of your holdings have not been affected. This incident relates to data, not to your money or your portfolio.”
• The company has been transparent about the breach, confirming that it has reported the matter to the relevant authorities and obtained judicial protection over the affected data.
• The incident highlights the importance of cybersecurity measures in the financial sector, particularly for asset management companies.

Key Takeaways

• HDFC AMC has advised investors to reset their passwords and be cautious of SIM-swap attempts.
• The company has confirmed that mutual fund units and portfolio values remain unaffected, but investor identity and financial data may have been exposed.
• HDFC AMC has reported the breach to the relevant authorities and obtained judicial protection over the affected data.

FAQs

What should I do if I suspect a SIM-swap attack?

Watch your phone closely. A sudden loss of mobile signal or an inability to receive calls and SMS can be an early warning of a SIM-swap attack, where a fraudster transfers your number to a new SIM to intercept OTPs. If your mobile unexpectedly loses network or stops receiving calls and SMS, please contact your telecom operator, as this can sometimes indicate a SIM-swap attempt.

How can I protect my account from phishing attacks?

Be sceptical of anything that arrives unexpectedly. HDFC AMC advises resetting your account credentials the next time you log in, using a strong password that you do not use on any other platform. The company is unambiguous on this: “We will never ask you for your password, OTP, PIN, or full bank details through email, SMS, or phone; please don’t share them with anyone. Please continue to be cautious of unexpected requests, particularly anyone asking you to act urgently. Don’t click any unknown links or attachments from unknown senders.”

What should I do if I suspect a data breach?

Review your account periodically and flag anything unfamiliar. For queries, the company’s support team is reachable at hello@hdfcfund.com or on 1800 3010 6767 / 1800 4197 676, from 9 a.m. to 6 p.m. Monday to Friday and 9 a.m. to 1 p.m. on Saturdays.

Conclusion

The HDFC AMC incident highlights the importance of cybersecurity measures in the financial sector, particularly for asset management companies. Investors are advised to reset their passwords and be cautious of SIM-swap attempts. HDFC AMC has reported the breach to the relevant authorities and obtained judicial protection over the affected data. As financial cybercrime across India accelerates sharply, it is essential for investors to remain vigilant and take necessary precautions to protect their accounts.