HDFC AMC: Morpheus Ransomware Breach and 680 GB Data Theft

HDFC Asset Management Company, one of India's largest mutual fund managers, has confirmed a serious security incident to investors after a threat actor calling itself Morpheus claimed to have stolen more than 680 GB of corporate and customer data. The disclosure, sent to millions of investors last Thursday evening, followed a May 16 intrusion into the company's on-premises VMware infrastructure. By June 10, 2026, Morpheus had listed HDFC AMC on its dark web leak site under the name "HDFC FUND," a posting captured by threat intelligence tracker RedPacket Security. The matter is now before the Bombay High Court, where filings refer to the perpetrators only as "unidentified hackers."

What Happened

On May 16, 2026, HDFC AMC's IT administrator discovered that critical portions of the company's on-premises VMware environment had gone offline. The affected systems were not random: VPN servers, SFTP servers, and antivirus management servers all became inaccessible at the same time. That specific combination is telling. When VPN and SFTP infrastructure go dark together while security tooling is disabled, it typically indicates an attacker who has already established persistence and is deliberately severing the defenders' ability to respond remotely while staging data for exfiltration over those same channels.

Later that same day, HDFC AMC received an extortion email from an entity identifying itself as Morpheus. The message claimed the group had extracted over 680 GB of data and threatened to publish all of it unless the company made contact within three days. Nearly four weeks later, on June 10, the group followed through on its threat infrastructure, posting HDFC AMC as a confirmed victim on its onion leak site. This was not an empty boast followed by silence; Morpheus maintains active leak infrastructure and used it.

HDFC AMC's public response to investors was deliberately narrow: reset your password, your portfolio holdings are safe, and external cybersecurity experts have been engaged. The language reflects a communication shaped by legal counsel operating under SEBI disclosure requirements, the CERT-In reporting mandate, and active Bombay High Court proceedings rather than a full technical accounting of the event.

What Was Taken

Morpheus claims a haul exceeding 680 GB, which it characterizes as "critical company data." The court petition filed by HDFC AMC describes the stolen material in more specific terms than the customer-facing email, though the company has not published a complete inventory publicly. The volume alone, well over half a terabyte, is consistent with bulk exfiltration of internal file shares, operational records, and customer-related datasets rather than a narrow, targeted theft.

The most concrete signal of the data's sensitivity is the company's own warning to investors about SIM swap fraud. Organizations issue SIM swap warnings when they have reason to believe attackers may hold the contact details and personal identifiers needed to hijack a victim's mobile number and intercept one-time passwords. That points toward the exposure of personally identifiable information such as names, phone numbers, email addresses, and account identifiers tied to millions of customers. While HDFC AMC has stated that investor portfolios themselves remain secure, the surrounding personal data appears to be the core of what is now at risk of publication.

Why It Matters

This incident sits at the intersection of financial services and large-scale personal data exposure, the highest-stakes category for downstream fraud. An asset management firm holds not only money but the full identity profile of its investors, exactly the raw material needed for targeted social engineering, account takeover, and SIM swap attacks. The explicit SIM swap warning is a strong indicator that defenders should treat affected customers as imminently targetable rather than theoretically at risk.

Morpheus is also notable for what is not known about it. The group does not appear in major ransomware tracking databases prior to this incident, has no documented affiliate relationships with established operations like LockBit or ALPHV, and has no long history of leak postings. That ambiguity could indicate a newer independent crew, a rebrand of an existing operation, or a small team running targeted intrusions rather than high-volume affiliate campaigns. For defenders, an actor with active, working leak infrastructure but no public playbook is harder to anticipate and harder to attribute, which is reflected in the court filings naming only "unidentified hackers."

The Attack Technique

The public technical picture centers on the simultaneous loss of VPN, SFTP, and antivirus management servers within HDFC AMC's on-premises VMware infrastructure. While the precise initial access vector has not been disclosed, the pattern is characteristic of a hands-on-keyboard intrusion. Attackers who reach the point of disabling antivirus management have typically already gained privileged access to the virtualization layer, allowing them to manipulate or take down multiple virtual machines at once.

Knocking out VPN access removes a primary remote response channel for the security team, while controlling SFTP servers provides a ready-built, often-trusted pathway for moving large volumes of data out of the environment. Exfiltrating 680 GB over existing SFTP infrastructure would blend into normal file-transfer activity far more easily than a novel covert channel. The targeting of VMware specifically aligns with a broader trend of threat actors going after hypervisor and virtualization management layers, where a single foothold can compromise an entire fleet of systems at once.

What Organizations Should Do

1. Harden the virtualization layer. Treat VMware vCenter, ESXi hosts, and hypervisor management interfaces as crown-jewel assets. Isolate them on dedicated management networks, enforce phishing-resistant multi-factor authentication, and apply patches promptly given the documented trend of attackers targeting this layer.

2. Monitor SFTP and VPN infrastructure for abuse. Alert on anomalous outbound transfer volumes, off-hours SFTP sessions, and unexpected configuration changes. The simultaneous failure of remote-access and file-transfer services should be treated as a high-severity incident, not a routine outage.

3. Protect antivirus and EDR management consoles. Configure tamper protection and generate immediate alerts when security tooling is disabled or its management server goes offline, since that is frequently an early sign of an active intrusion.

4. Prepare customers for SIM swap and phishing fraud now. If you hold customer contact and identity data, proactively advise users to set up carrier-level SIM swap protections, prefer authenticator apps over SMS one-time passwords, and stay alert to targeted phishing referencing their accounts.

5. Maintain offline, tested backups and an out-of-band response plan. Assume primary VPN access may be lost during an incident, and ensure your responders can reach critical systems through an independent channel.

6. Rehearse breach disclosure under regulatory pressure. Align legal, security, and communications teams in advance so that mandated SEBI and CERT-In notifications can be issued accurately without leaving customers without actionable guidance.

Sources: HDFC AMC Data Breach 2026: Morpheus, 680 GB & What It Means | The CyberSec Guru