INDUSTRY FACT FILE · ITES, BPO, KPO & GCCS

Five New Case Studies in ITeS and GCC Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in service centres and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Agent Who Sold Screenshots 3.  Case Study 2: The Help Desk That Reset the Wrong MFA 4.  Case Study 3: The Vendor Master Change in Shared Services 5.  Case Study 4: The Home Laptop That Kept Customer Files 6.  Case Study 5: The GCC Account That Reached Headquarters

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in ITeS, BPO, KPO and GCC operations with the obligations that apply in India as of October 2026—in particular CERT-In's Directions, the DPDP framework, PCI DSS and client regulators' outsourcing requirements.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Centre type	Core threat	Regulatory lens	Primary bundles
1. The Agent Who Sold Screenshots	Contact centre	Insider data theft and bribery	CERT-In; DPDP; client contracts	B6, B7, B8
2. The Help Desk That Reset the Wrong MFA	BPO with internal IT help desk	Help-desk social engineering	CERT-In; client contracts	B3, B10, B7
3. The Vendor Master Change in Shared Services	Shared service centre	BEC and vendor-master fraud	Group policies; CERT-In	B10, B4, B7
4. The Home Laptop That Kept Customer Files	BPO with work-from-home teams	Unmanaged remote devices and local data	CERT-In; DPDP; HIPAA via client	B3, B6, B8
5. The GCC Account That Reached Headquarters	Global capability centre	Privileged access into parent systems	CERT-In; parent and home-country rules	B3, B7, B8

The data never left the network. It left on a phone.

At a glance
Organisation	A contact centre (“Centre A”) supporting a bank's credit-card customers
Threat	Agents recruited online to photograph customer records with personal phones
Why it is new	Bribery bypasses technical controls entirely
Codec Networks services	Masking and access review, UEBA, insider investigation (Bundles B6, B7, B8)

The scenario

A criminal group advertised 'easy extra income' to contact-centre agents on social media and messaging apps.

Several agents at Centre A began photographing customer records—names, card details and recent transactions—on their personal phones.

The data was used for convincing impersonation calls. The bank noticed fraud cases clustering around customers served by one site.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Full customer data was shown on every screen.
• Phones were allowed on the floor.
• Unusual look-ups were not monitored.
• No insider threat programme existed.

The impact

Centre A faced a client investigation, contract penalties, reporting obligations and the risk of losing the account.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Client regulator rules: the bank must oversee its service provider and may report the incident.
• DPDP Act and Rules: safeguards and breach intimation by the client once provisions commence.
• PCI DSS: protection of card data viewed by agents.

How Codec Networks would help

Need	Codec Networks response	Bundle
Show less	Masking and least-privilege review	B6
Spot the pattern	UEBA on unusual look-ups	B7
Investigate	Forensic insider investigation	B8

Key lessons Mask what agents don't need. Keep phones off sensitive floors. Monitor look-up patterns. Run an insider threat programme.

He sounded like the operations head. He knew the right names.

At a glance
Organisation	A BPO (“BPO B”) whose staff access several clients' systems
Threat	A caller impersonating a manager obtained a password and MFA reset
Why it is new	Help-desk impersonation is a leading route to account takeover
Codec Networks services	Help-desk control testing, simulations, identity monitoring (Bundles B3, B10, B7)

The scenario

A caller claiming to be a senior operations manager rang BPO B's IT help desk, citing a lost phone and an urgent client escalation.

Using details gathered from social media, the caller passed weak verification questions. The agent reset both the password and MFA.

The attacker logged in, reached client systems, stole data and deployed ransomware.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Verification relied on public information.
• MFA resets needed no out-of-band approval.
• Resets followed by unusual access raised no alert.
• Help-desk staff had never been tested.

The impact

Several clients were affected; BPO B faced outages, multi-party investigations and contract claims.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Client contracts: access control and notification obligations.
• Client regulators: regulated clients may report provider-caused incidents.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden resets	Help-desk verification and approval controls	B3
Test the desk	Social-engineering simulations	B10
Spot takeover	Alerts on resets followed by unusual access	B7

Key lessons Never verify with public facts. Approve MFA resets out of band. Watch what happens after a reset. Test your help desk regularly.

The letter was on the vendor's letterhead, from the vendor's real email address.

At a glance
Organisation	A shared service centre (“SSC C”) running accounts payable for a multinational group
Threat	A compromised vendor mailbox used to request a bank-detail change
Why it is new	Payment runs concentrate large sums in routine processes
Codec Networks services	BEC simulation, payment-control audit, SOC monitoring (Bundles B10, B4, B7)

The scenario

Attackers compromised a supplier's email account and studied its invoicing with SSC C.

They sent a request to update bank details, with a convincing letter attached. An agent updated the vendor master the same day.

The next payment run sent a large sum to a mule account. The supplier complained of non-payment weeks later.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No call-back verification on a known number.
• No maker-checker approval for bank changes.
• Payment anomalies were not monitored.
• Finance staff had no BEC training.

The impact

The group suffered a financial loss and the parent company's audit committee ordered a review of SSC C's controls.

The regulatory lens

• Group financial controls: segregation of duties and approval requirements.
• CERT-In Directions: cyber incidents, including BEC-related compromise, reported within six hours where applicable.
• Law enforcement: prompt reporting improves recovery chances.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train finance	BEC simulation and awareness	B10
Audit the process	Payment and vendor-master control audit	B4
Spot anomalies	Payment and mailbox monitoring	B7

Key lessons Call back on a known number. Require maker-checker approval. Monitor unusual payments. Train finance teams on BEC.

The files were saved 'just for today'. The laptop was stolen that night.

At a glance
Organisation	A BPO (“BPO D”) processing medical billing for an overseas healthcare client
Threat	Customer files saved locally on an unencrypted WFH laptop that was stolen
Why it is new	Remote delivery moves data outside controlled facilities
Codec Networks services	WFH and VDI assessment, DLP, incident response (Bundles B3, B6, B8)

The scenario

BPO D moved a billing team to work from home on lightly managed laptops.

To work around slow connectivity, agents saved patient files locally. One laptop, without disk encryption, was stolen from a car.

BPO D had to determine what data was on the device, notify the client and report the incident.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No VDI or locked-down devices.
• Disk encryption was not enforced.
• DLP did not block local saves.
• WFH setups were never audited.

The impact

BPO D faced client notification duties under the client's HIPAA obligations, CERT-In reporting and a demand for remediation.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Client obligations: HIPAA breach rules for the US healthcare client, applied through contract.
• DPDP Act and Rules: safeguards for personal data once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Secure remote work	VDI and WFH assessment	B3
Stop local copies	DLP assessment and policy tuning	B6
Respond fast	IR retainer and notification support	B8

Key lessons Deliver sensitive work through VDI. Enforce disk encryption. Block local saves and USB. Audit home setups.

The account belonged to India. The damage happened everywhere.

At a glance
Organisation	A GCC (“GCC E”) running IT operations for a global manufacturer
Threat	A phished GCC engineer account with broad rights in the parent's directory
Why it is new	GCCs increasingly hold global privileges
Codec Networks services	PAM and tiered admin review, joint SOC, cross-border IR (Bundles B3, B7, B8)

The scenario

A GCC E engineer held broad administrative rights in the parent's global directory for operational convenience.

Attackers phished the engineer with an MFA-relay page and captured a session.

Using those privileges, they moved into data centres worldwide and deployed ransomware, triggering reporting obligations in several countries.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No tiered admin model.
• MFA was not phishing-resistant for privileged users.
• India and global SOCs were not coordinated.
• No cross-border incident playbook.

The impact

The parent faced global outages and multi-country regulatory reporting, and reviewed the GCC's operating model.

The regulatory lens

• CERT-In Directions: incidents in India reported within six hours.
• Parent and home-country rules: notification duties in other jurisdictions.
• DPDP Act and Rules: safeguards for personal data processed in India once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Contain privilege	PAM and tiered admin review	B3
Watch together	Joint India–global SOC monitoring	B7
Respond across borders	Cross-border IR playbook and support	B8

Key lessons Tier administrative access. Use phishing-resistant MFA for admins. Join up India and global monitoring. Plan for cross-border reporting.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com