Top News

BENGALURU: Zerodha co-founder and CEO Nithin Kamath revealed on Wednesday that his personal account on social media platform X (formerly Twitter) was hacked after he accidentally clicked on a phishing email, triggering a conversation on cybersecurity awareness and human error.

In a detailed post shared on X, Kamath said the incident took place early Wednesday morning while he was browsing on his personal device at home. The email, he said, “got through all spam and phishing filters,” and in a “momentary lapse in attention,” he clicked on a ‘Change Your Password’ link and entered his login credentials.

He clarified that the damage was contained because he had two-factor authentication (2FA) enabled, which prevented the hackers from gaining full control of his account.

Attack appeared AI-driven, not targeted

Kamath said the phishing attack appeared to be fully AI-automated rather than a targeted attempt against him personally.

The incident underscores a rising trend in AI-powered phishing attacks, which mimic legitimate corporate or platform communications with high accuracy. Cybersecurity experts have warned that such attacks are becoming increasingly sophisticated, often bypassing traditional spam filters.

Kamath calls for holistic cybersecurity practices

Reflecting on the experience, Kamath emphasised that technical defences like 2FA alone are not enough. He urged individuals and organisations to adopt a holistic cybersecurity framework that accounts for human psychology — the “weakest link” in most systems.

He added that even though Zerodha regularly conducts awareness and policy sessions on online security, he still fell for the phishing link.

Kamath’s candid admission resonated across social media, as users praised his transparency and the reminder that cybersecurity failures can happen to anyone, regardless of technical expertise.

Phishing and the human factor

Phishing attacks — fraudulent attempts to obtain sensitive information by impersonating trusted entities — have been on the rise in India. According to CERT-In (Indian Computer Emergency Response Team), phishing and digital fraud incidents surged by nearly 30% in 2024, targeting not just individuals but also fintech and government portals.

Experts say the increased use of AI and automation has made phishing emails more convincing, allowing them to slip past standard security filters. These attacks often employ cloned login pages, urgent language, and official-looking branding to lure victims.

“Even the best spam filters can’t detect every cleverly crafted message. That’s why user training and awareness are as critical as firewalls or 2FA,” said a Bengaluru-based cybersecurity consultant.

Social media users react

Kamath’s post sparked widespread discussion on X, with many users sharing their own experiences with phishing emails.

Another wrote, “There are many such phishing emails coming in lately. The biggest question is, how did they get our email addresses? We never publicly shared them!”

A third user summed up the sentiment succinctly:

Growing phishing risks for Indian businesses

India’s rapidly digitising financial and startup ecosystem has become a prime target for cybercriminals, especially those using phishing to infiltrate business and personal accounts.

A recent report by Kaspersky noted that over 70% of Indian enterprises reported at least one phishing attempt in the past year, with most attacks focusing on financial institutions, stockbrokers, and tech entrepreneurs.

Zerodha, India’s largest retail brokerage, handles millions of client accounts, and Kamath’s openness about the hack may prompt other industry leaders to reassess their digital hygiene practices.

Conclusion

Kamath’s admission serves as a timely reminder that cybersecurity is not merely a technical challenge but a human one. Even the most tech-savvy individuals are susceptible to split-second lapses in judgment. As phishing tactics become more AI-driven and realistic, experts urge both individuals and companies to implement layered security systems, continuous awareness training, and cautious digital behaviour.