INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS

Five New Case Studies in Group and Investment Firm Security

Original 2026 case studies, each written as a blog post, showing how current threats play out at business groups, holding companies, family offices, PE funds and shared-services centres, and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Subsidiary That Took the Group Down 3.  Case Study 2: The Breach That Came With the Deal 4.  Case Study 3: The Promoter's Voice on the Call 5.  Case Study 4: The Portfolio Nobody Measured 6.  Case Study 5: The Shared Services Login

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining control failures widely observed in groups and investment firms with the obligations that apply in India as of October 2026—in particular the Companies Act 2013, SEBI's LODR, PIT Regulations and CSCRF, RBI's directions for core investment companies, CERT-In's Directions and audit guidelines, the IT Act and the DPDP Act. Attack techniques are described only at the level needed to explain the controls; no operational detail is given, and pre-acquisition testing is described only as authorised work with the target's consent.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Subsidiary That Took the Group Down	Diversified business group	Acquired subsidiary used to reach shared group systems	CERT-In; SEBI LODR; DPDP; IT Act	B3, B7, B8
2. The Breach That Came With the Deal	Listed holding company	Undetected intruder inherited through an acquisition	DPDP; SEBI LODR; deal warranties; CERT-In	B1, B9, B8
3. The Promoter's Voice on the Call	Family office	Deepfake impersonation approving urgent transfers	IT Act; bank terms; CERT-In; DPDP	B10, B7, B8
4. The Portfolio Nobody Measured	Private equity fund	Ransomware at an unmeasured investee before exit	SEBI AIF and CSCRF; buyer diligence; CERT-In	B5, B1, B7
5. The Shared Services Login	Group shared-services centre	Phished outsourcer admin account exposing group HR data	DPDP; CERT-In; outsourcing contract	B3, B9, B6

The acquisition closed on a Friday. The trust between the directories went live on Monday.

At a glance
Organisation	A listed diversified group (“Groupco A”) with nine operating companies in manufacturing, distribution and consumer brands, sharing one group directory, email platform and ERP run by a group IT team
Threat	A newly acquired subsidiary's old VPN had no MFA and a reused administrator password, and a directory trust created at integration let attackers reach group domain controllers
Why it is new	Integration deadlines connect weak acquisitions to strong groups before anyone checks them
Codec Networks services	Directory and trust review, shared SOC, incident response (Bundles B3, B7, B8)

The scenario

Groupco A bought a regional distributor to extend its reach. To give the new team group email and ERP quickly, group IT created a two-way trust between the distributor's directory and the group's within a week of closing and left the distributor's own VPN in place until a later migration. That VPN accepted passwords alone, and the distributor's administrators used one password across several systems. No compromise assessment had been done, and the distributor's servers were not yet in the group SOC's view.

Attackers who had bought the distributor's VPN credentials on a criminal forum logged in, found the new trust and used the reused administrator password to move into the group directory. Over a fortnight they mapped group servers, disabled backup jobs and, early on a Sunday, deployed ransomware to the shared ERP, file servers and many endpoints in all nine companies.

On Monday invoices, payroll and dispatch stopped across the group. Groupco A isolated the distributor and then each company's links, engaged incident responders, reported to CERT-In within six hours, informed its lenders and insurers and assessed disclosure to the stock exchanges. Restoring the ERP and directory from offline copies took eight days, with some companies on manual processes for longer.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• A trust created before any security gate for the acquired company.
• Password-only VPN and a reused administrator password.
• No separate admin tier for group-wide accounts.
• Acquired servers outside SOC monitoring.

The impact

Nine companies lost a week of trading, suppliers and dealers were paid late, the group bore response and recovery costs and made disclosures to the stock exchanges, and its risk committee commissioned a group-wide review; Groupco A introduced integration security gates, tiered administration, MFA on all remote access and SOC coverage from Day 1 of every acquisition.

The regulatory lens

• CERT-In Directions: each affected body corporate reported within six hours of noticing the incident; logs preserved for the investigation.
• SEBI LODR: the incident and losses disclosed in the quarterly corporate governance report under Regulation 27(2)(ba), with event disclosure assessed for materiality; the risk management committee reviewed the response.
• DPDP Act and IT Act: employee and customer data on encrypted servers assessed for exposure by each data fiduciary once provisions commence; the intrusion is an offence under the IT Act.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the identity paths	Directory, trust and privileged access review, tiered administration and integration security gates	B3
Watch every entity	Shared 24x7 SOC with cross-entity detection, onboarding acquired companies from Day 1	B7
Contain and recover	Ransomware response, forensics, isolation and reporting support	B8

Key lessons Gate every acquisition before you connect it. Separate group-wide admin accounts. Put MFA on every remote door. Monitor new companies from Day 1.

The financial model was perfect. Nobody had looked for an attacker.

At a glance
Organisation	A listed holding company (“Holdco B”) that acquired a fast-growing consumer subscription platform with several million customer accounts after a financial and legal due diligence process
Threat	An intruder who had been inside the target's cloud environment for months kept access after closing and later exfiltrated customer data
Why it is new	Unknown cyber liabilities pass to the buyer with the business
Codec Networks services	Cyber due diligence and testing, third-party and target assurance, forensics (Bundles B1, B9, B8)

The scenario

Holdco B's deal team ran a competitive process on a tight timetable. Financial, tax and legal diligence were thorough, and the target completed a short security questionnaire stating that it had no known incidents. No technical diligence, external exposure review or compromise assessment was done. The share purchase agreement contained general warranties on compliance with laws but no specific cyber warranties or indemnity.

Months before the deal, an attacker had used leaked developer credentials to reach the target's cloud account and created a hidden access key. After closing, the platform kept its own cloud environment, and the key continued to work. Seven months later the attacker copied customer records, including names, contact details and partial payment data, and offered them for sale online.

A threat intelligence alert reached Holdco B's group CISO. Investigators found the access key and traced it to activity before signing. Holdco B contained the intrusion, reported to CERT-In, prepared DPDP notifications, assessed disclosure to the stock exchanges and raised a warranty claim against the sellers, who disputed it.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No technical cyber diligence before signing.
• No compromise assessment before closing.
• No specific cyber warranty or indemnity in the agreement.
• The acquired cloud estate left outside group monitoring.

The impact

Holdco B paid for investigation, notification and customer support, faced DPDP questions and press coverage, saw subscriber churn and spent a year in a contested warranty claim; it made cyber diligence and compromise assessments mandatory for material deals and added cyber warranties and specific indemnities to its deal templates.

The regulatory lens

• DPDP Act: the acquired company, as data fiduciary, responsible for safeguards and breach intimation once provisions commence; the group's role in processing assessed.
• SEBI LODR: the incident considered for quarterly governance report and event disclosure by the listed holdco where material.
• Deal documents and CERT-In: warranty, indemnity and limitation terms decided cost recovery; the incident reported to CERT-In within six hours of noticing it.

How Codec Networks would help

Need	Codec Networks response	Bundle
Look before you sign	External exposure, leaked credential and architecture review of the target with its consent	B1
Assure the target and its suppliers	Questionnaire validation, key supplier review and cyber warranty inputs	B9
Check for intruders	Compromise assessment before closing and forensics if one is found	B8

Key lessons Diligence cyber like you diligence finance. Look for intruders before closing. Write cyber into the agreement. Monitor the target from Day 1.

It was his voice, his face and his way of speaking. It was not him.

At a glance
Organisation	A single-family office (“Famco C”) that manages investments, property and payments for a promoter family, with a small finance team authorised to make transfers on the principal's instruction
Threat	Criminals used public videos of the promoter to clone his voice and face and, on a video call, instructed staff to fund a confidential acquisition
Why it is new	Deepfakes defeat controls that rely on recognising the person giving the instruction
Codec Networks services	Treasury control testing and deepfake simulation, monitoring, fraud response (Bundles B10, B7, B8)

The scenario

Famco C's finance team was used to urgent instructions from the promoter, who travelled often and disliked delays. Transfers needed one approver, and the team often skipped call-backs when the instruction came directly from him. The promoter appeared regularly in interviews and conference videos, and his travel plans were often visible on social media.

One evening a finance manager received a message, apparently from the promoter's assistant, about a confidential acquisition abroad that required an immediate deposit into an escrow account. A short video call followed in which the promoter and a 'lawyer' explained the deal; both were deepfakes built from public footage. The manager made two transfers to the account.

When the promoter's real assistant called the next morning on another matter, the fraud surfaced. Famco C asked its bank to recall the funds, filed a police complaint, engaged investigators and reported the incident to CERT-In. Part of the money was frozen abroad; the rest had already moved.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• A single approver for large transfers.
• Call-backs skipped for instructions that seemed to come from the principal.
• No procedure for confidential or urgent deals.
• Staff untrained in deepfake requests.

The impact

Famco C lost a large part of the transferred sum, the family's trust in its systems was shaken and its bank reviewed the account mandate; it introduced dual approval, mandatory call-backs to known numbers, code words, cooling periods for new payees, privacy reviews of the family's public footprint and regular deepfake simulations.

The regulatory lens

• IT Act and criminal law: impersonation and cheating by personation using computer resources are offences under the IT Act; a police complaint started the recovery process.
• Bank terms: the account mandate and the bank's fraud and recall procedures shaped what could be recovered.
• CERT-In and DPDP: the incident assessed against CERT-In reporting criteria; family and staff personal data used in the fraud reviewed under the DPDP Act once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the approvals	Treasury control testing, deepfake and BEC simulations, awareness for principal and staff	B10
Watch the payments	Monitoring of new payees, unusual timing and email anomalies	B7
Respond to fraud	Fraud investigation, evidence for police and bank, reporting support	B8

Key lessons Never trust a face or voice alone. Two approvers for every large transfer. Call back on a number you already know. Rehearse the urgent, secret request.

The fund knew every investee's EBITDA. It knew none of their backups.

At a glance
Organisation	A mid-market private equity fund (“Fundco D”) with twelve portfolio companies across manufacturing, healthcare services and consumer businesses, managed by a SEBI-registered AIF manager
Threat	One manufacturing investee ran unpatched remote access and kept backups on the same network, and ransomware stopped production six months before a planned sale
Why it is new	Portfolio cyber risk becomes an exit value and LP question
Codec Networks services	Portfolio maturity scoring, investee testing, portfolio SOC (Bundles B5, B1, B7)

The scenario

Fundco D's operating team tracked finance, sales and operations metrics for every investee, but cyber was left to each management team. There was no common baseline, and Board packs reported 'no incidents' without evidence. The manufacturing investee had grown by acquisition, ran an unpatched remote access appliance and backed up its servers to storage on the same network.

Attackers exploited the appliance, spent two weeks inside and encrypted ERP, file servers and backups, along with the PCs that ran production scheduling. Production stopped for eleven days, customers invoked late-delivery penalties and the company reported the incident to CERT-In and informed its lenders.

When the sale process began, the buyer's cyber diligence found the incident, other unpatched systems and no monitoring. The buyer cut its offer and required remediation before closing, and the exit slipped by two quarters. Fundco D's LPs asked how other investees were measured.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No cyber baseline at investment.
• Unpatched remote access at an investee.
• Backups reachable from the systems they protected.
• Board packs that reported no incidents without evidence.

The impact

The investee lost revenue and paid penalties, the exit value fell and was delayed, and Fundco D faced LP questions; it introduced a common cyber baseline at entry, annual maturity scoring across the portfolio, backup testing, a portfolio SOC and exit readiness reviews, and reviewed the manager's own CSCRF position.

The regulatory lens

• SEBI AIF Regulations and CSCRF: the manager's own cyber resilience duties reviewed for its category; investor reporting on material portfolio events handled under fund documents.
• Buyer diligence: findings shaped price, conditions and specific indemnities in the sale.
• CERT-In Directions: the investee reported within six hours of noticing the incident; logs preserved.

How Codec Networks would help

Need	Codec Networks response	Bundle
Measure the portfolio	Common baseline at entry and annual maturity scoring across investees	B5
Test the weak spots	Investee external exposure, VAPT and backup reviews	B1
Watch the portfolio	Portfolio SOC and incident escalation to the fund	B7

Key lessons Set a cyber baseline at entry. Score every investee every year. Test backups, not just reports. Prepare for the buyer's diligence early.

Twenty companies trusted one centre. The centre trusted one password.

At a glance
Organisation	A group shared-services centre (“Serveco E”) that runs HR, payroll and finance operations for twenty group companies on a shared HR and payroll platform supported by an IT outsourcer
Threat	An outsourcer engineer's administrator account had no MFA; its password was phished and the account used at night to export HR records of employees across the group
Why it is new	Shared platforms concentrate the data of many companies behind a few privileged accounts
Codec Networks services	Privileged access review, outsourcer assurance, group DPDP programme (Bundles B3, B9, B6)

The scenario

Serveco E's HR platform held records of employees across all twenty companies: identity documents, bank accounts, salaries, family details and health benefit data. The IT outsourcer's engineers had standing administrator accounts protected by passwords only, used from their own laptops. Access was not segregated by company, and exports were not monitored.

An engineer received a message that appeared to come from the platform vendor's support portal and entered his credentials on a fake page. Over two nights the attackers used his account to export HR records for every group company to an external storage service.

The outsourcer's own monitoring flagged the unusual exports days later. Serveco E disabled the account, engaged investigators and reported to CERT-In. Because each group company was a separate data fiduciary, each had to assess the exposure of its employees' data and prepare notices, while employees' bank accounts were watched for fraud.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Standing admin accounts without MFA for outsourcer engineers.
• No segregation of access or data by group company.
• More personal data held than processes needed.
• No alerts on bulk exports or night-time use.

The impact

Twenty companies faced employee concern, investigation and notification costs and DPDP questions, the outsourcer's contract was reviewed and the centre's model questioned; Serveco E introduced MFA and privileged access management for all vendor administrators, segregation by entity, data minimisation and masking, export alerts and annual outsourcer assessments.

The regulatory lens

• DPDP Act: each group company, as data fiduciary, responsible for its processors' safeguards and for breach intimation once provisions commence; Serveco E and the outsourcer acted as processors under contract.
• CERT-In Directions: the incident reported within six hours of noticing it; outsourcer and platform logs preserved.
• Outsourcing contract: security, audit and notification clauses decided the outsourcer's duties and cost sharing.

How Codec Networks would help

Need	Codec Networks response	Bundle
Lock down privileged access	MFA, privileged access management and segregation by entity for shared platforms	B3
Assure the outsourcer	Security assessment of IT outsourcers and MSPs, contract security clauses	B9
Govern group data	Group DPDP programme, data minimisation and processor contracts	B6

Key lessons No standing admin without MFA. Segregate shared platforms by company. Hold only the data each process needs. Alert on bulk exports and odd hours.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com