Borderless Investing Reports No Platform Breach in Stockal Unauthorised Trading Incident

Borderless Investing, the parent company of investment platform Stockal, announced on Wednesday that its ongoing investigation has found no evidence of a breach or compromise of its platform, interface, infrastructure, or internal systems. The statement follows recent investor allegations regarding the unauthorised liquidation of US stock holdings and reported losses exceeding ₹100 crore.

According to Borderless, its US brokerage and custody partner, DriveWealth, flagged unauthorised trading activity in 13 customer accounts during US market hours on October 15. The alert was communicated to Stockal on October 16, India time. The company stated that an unauthorised third party appeared to have accessed 26 accounts using valid login credentials. In 13 of those accounts, existing large-cap US equity holdings were sold, and the proceeds were used to purchase thinly traded microcap securities. Borderless confirmed that no funds were withdrawn during the incident.

To independently examine its infrastructure, the company has engaged cybersecurity specialists. Borderless noted that affected account holders may have been victims of a social-engineering attack involving credentials exposed in an unrelated third-party data breach several weeks prior, though this link remains under investigation.

Following the discovery, access to the affected accounts was restricted. The company also implemented additional authentication and account-protection measures as a precaution. Borderless maintained that the unauthorised trading was isolated to the 13 identified accounts, with no broader threat detected across its wider platform, other products, or customer base.

Borderless teams are currently in direct communication with impacted customers and are coordinating with DriveWealth to review transactions and explore avenues for resolution. The company clarified that assistance being provided to customers is done in good faith and does not constitute an admission of liability, wrongdoing, negligence, or responsibility for the unauthorised activity.

In a related development, HDFC Securities clarified that its operational partnership with Stockal concluded in 2024. Responding to reports surrounding the First Information Report (FIR) filed in the matter, HDFC Securities confirmed it has not been named among the accused.

Borderless stated that it is fully cooperating with relevant authorities and regulators as the investigation continues, and further updates will be shared as verified facts emerge.

"This incident highlights critical challenges around credential management and cybersecurity vulnerabilities that extend beyond individual platforms. When third-party login credentials are compromised through external breaches, fintech companies face severe trust and operational risks. For growing digital platforms, proactive fraud monitoring, rapid incident response, and transparent communication with users and regulators are essential to maintaining market integrity and protecting investor confidence." — Dr. Shishir Gupta, Founder & CEO, StartupLanes