What will happen to demat shares if cyberattack on cdsl?

[Pai]

Nithin had answered this earlier,

@Passionate_trader

just a out of curiosity question if there is a cyberattack on cdsl and all the data got lost or got corrupted , then what will happen, because a retail investor doesn’t have any physical document as a proof to show that he was a shareholder of that company.

1. CDSL and NSDL maintain backups of all investor data across different locations. These backups are regularly updated.
2. SEBI has mandated strict cybersecurity protocols for depositories, including disaster recovery mechanisms.
3. Registrar and Transfer Agent also maintains shareholding data. RTAs are appointed by companies and mutual funds to maintain records of investors and manage their transactions.

Regarding Zerodha specifically, brokers maintain their own records and also have to report to depositories and exchanges. Also reinforced by backups and disaster recovery mechanisms.

Here are the older threads where Nithin also shared some views,

CDSL unavalibility

Holdings can’t really be stolen like in Crypto. If somehow shit hit the fan and the accounts got compromised, stocks can be only moved from one CDSL to another CDSL/NSDL account. So the stocks will remain in the depository ecosystem itself and in their control, they can’t be moved to say an account in the Bahamas. Yeah, there will be external hard disks not connected to the systems that act as a backup as well. I guess CDSL will soon share an RCA (Root cause analysis) and all t…

What happens if a Depository is hacked?

Unlike Money that can be transferred and withdrawn/spent, you can’t really do that with securities. So assuming CDSL gets hacked and say you have 100 shares of Reliance. What can the hacker do with the 100 shares? The only thing he can do is to move it to another Demat account with NSDL or CDSL. The shares transferred can be sold and withdrawn to a bank account. But this takes atleast 3 days. The hack will most likely be spotted by then and accounts blocked.

(Settlement is T+1 now, not 3 days anymore )