Data Breach Statistics India: CERT-In and Breach Costs
Data breach statistics India: what CERT-In counts, how to read IBM's Cost of a Data Breach India figure, and what the DPDP Act now requires after a breach.
In short
- CERT-In''s annual incident count is the only official Indian breach statistic; it counts incidents reported to or detected by CERT-In.
- IBM''s Cost of a Data Breach gives an India average cost in rupees from a survey of breached organisations; it is an average of a sample, not a national total.
- Verizon''s DBIR reports patterns and shares of analysed incidents, globally and by region; it is not an India count.
- Under the DPDP Act, 2023, section 8(6), a data fiduciary must notify the Data Protection Board and each affected person of a breach; penalties under the Act go up to ₹250 crore.
- CERT-In''s six-hour reporting rule since 2022 and the DPDP duty together mean every breach now has two reporting clocks.
Who this is for: Compliance officers, founders, IT managers and journalists who need an India breach figure with a source behind it, and individuals wondering how often their data leaks.
Ask three people for data breach statistics India can rely on and you will get three different numbers: a CERT-In incident count, an IBM average cost in crore, and a Verizon percentage. All three are real, and none of them is "the number of data breaches in India", because nobody publishes that. This guide explains what each source counts, where the India figure sits inside each report, and what the law now requires an organisation to do when it becomes a statistic.
We do not reproduce the counts or costs here, because they change annually and because a number copied from a press release is worth less than the table it came from. The links go to the landing pages; the sections below tell you where to look once you are there.
Data breach statistics India publishes: CERT-In
CERT-In, the national incident response team under section 70B of the IT Act, is the only Indian body that publishes an official security-incident count. Its annual report on cert-in.org.in has a table of incidents handled, by category: phishing, website intrusions, unauthorised access, data breaches, ransomware, malware, vulnerable services and others. MeitY repeats the headline total in Lok Sabha and Rajya Sabha replies, which are searchable on sansad.in and are often the fastest way to get the latest year.
Two things to know before quoting it. First, the count covers all incident types, so "CERT-In handled N incidents" is not "N data breaches"; look for the breach row if the table gives one. Second, it counts what was reported to CERT-In or detected by it. Since the directions of 28 April 2022, organisations must report listed incidents within six hours and keep logs for 180 days. The six-hour reporting rule should make the count more complete over time. Compliance is uneven, and many small businesses have never heard of the rule. Our guide to CERT-In incident reporting explains who it covers.
Which report measures what
| Source | What it gives | How it is collected | Where the India figure is |
|---|---|---|---|
| CERT-In annual report | Count of security incidents handled, by category. | Reports under the 2022 directions plus CERT-In's own detection. | Incidents table; MeitY parliamentary replies repeat the total. |
| IBM Cost of a Data Breach | Average cost per breach, globally and by country, by industry and by attack type. A ransomware and a lost-business sub-analysis. | Survey of organisations that suffered a breach in the study window, with research by the Ponemon Institute. | Section on cost by country or region, listed as India, in rupees. Methodology page gives the sample size. |
| Verizon DBIR | Patterns and shares: how breaches start, who the actors are, which sectors, by region. | Incidents contributed by partner organisations worldwide. | Regional section for Asia-Pacific; no India-only count. |
| Vendor telemetry reports | Detections and leaked-credential counts "for India". | The vendor's own customer base and scanning. | Varies; always labelled by vendor and method. |
Read the "how it is collected" column before the figure. An average from a survey, a count of reported incidents and a share of a partner dataset answer three different questions.
Reading the IBM India figure correctly
The Cost of a Data Breach report is the most quoted breach-cost study in the world, and it has included India as a separate country for years. The India figure is an average total cost per breach across the Indian organisations in that year's sample, expressed in rupees. It is built from detection, notification, lost business and post-breach response costs as those organisations reported them. It moves year to year partly because the sample changes.
Use it as a planning number, not a statistic about India. "The average cost of a breach for the Indian organisations surveyed by IBM in (year) was ₹X crore" is accurate. "Data breaches cost India ₹X crore" is not, and multiplying the average by a CERT-In incident count to get a national total is the most common error we see; the two sources do not share a definition of "breach".
The one number that is fixed by law, not by survey. Penalties under the Digital Personal Data Protection Act, 2023 run up to ₹250 crore for failure to take reasonable security safeguards, with separate ceilings for other breaches of the Act. (Source: DPDP Act, 2023, Schedule; verify at indiacode.nic.in.)
What the DPDP Act and CERT-In require after a breach
Statistics are retrospective; obligations are immediate. Since 1 July 2024 the criminal codes have changed, and the Digital Personal Data Protection Act, 2023 has added a civil regime for personal data. The sections below are quoted for orientation; verify at indiacode.nic.in, and check meity.gov.in for which Rules are in force.
| Obligation | Provision | Clock | Consequence |
|---|---|---|---|
| Report the incident to CERT-In | IT Act s.70B. CERT-In directions of 28 Apr 2022. | Within six hours of noticing. | Non-compliance punishable under s.70B(7). Up to one year and/or fine. |
| Keep logs available | CERT-In directions. | 180 days, within India. | Same. |
| Notify the Data Protection Board and affected individuals | DPDP Act s.8(6). | As prescribed by the Rules. | Penalty per the Schedule. |
| Reasonable security safeguards | DPDP Act s.8(5). | Ongoing. | Up to ₹250 crore. |
| Police complaint for the intrusion and any extortion | IT Act ss.43 and 66. BNS s.308 where a ransom is demanded. | As soon as practical. | Needed for insurance and for any recovery. |
One incident starts both reporting clocks, and they have different recipients. A workable response plan names an owner for each breach notification. That is the structure of our breach response plan template. The organisational checklist for the Act is in our DPDP compliance checklist.
What the statistics mean for an individual
For a person, the practical reading of all this is that your data has probably been in several breaches already, that the organisation responsible may not have told you, and that the scams you receive are built on it. The caller who knows your bank, your loan amount or your recent order got it from a leak, not from magic. The DPDP Act gives you a right to be told; until that becomes routine, check for yourself using the steps in our guide on how to check if your data was leaked, change reused passwords, and assume that anyone who contacts you with your own details might be a fraud.
For an organisation, the sensible response to data breach statistics India is not to find a reassuring number but to be ready for the two clocks. Our DPDP compliance service builds the notification process and the safeguards the Act expects, and our HR data-handling programme trains the people who hold the most personal data in most companies. For the wider set of verified figures on cyber crime in India, see the statistics overview.
Frequently asked questions
How many data breaches happen in India each year?
There is no official count of breaches as such. CERT-In publishes the number of security incidents it handled, by category, and MeitY repeats the totals in parliamentary replies. Those include many incident types besides breaches and count only what was reported or detected. Treat the figure as a floor and quote it with the year.
Where is the India figure in the IBM Cost of a Data Breach report?
Open the current report at ibm.com/reports/data-breach and look for the section on cost by country or region; India is listed with an average cost in rupees. Also read the methodology page: the figure is the average across the Indian organisations in that year's sample, and the sample size is stated there.
What does the DPDP Act require after a breach?
Section 8(6) requires a data fiduciary to intimate the Data Protection Board and each affected data principal of a personal data breach, in the form and manner set by the Rules. Section 8(5) requires reasonable security safeguards. Penalties under the Act's schedule run up to ₹250 crore for failure of safeguards. Verify the current text and the notified Rules at indiacode.nic.in and meity.gov.in.
Is the six-hour CERT-In rule the same as DPDP notification?
No. The CERT-In directions of 28 April 2022 require incidents, including data breaches, to be reported to CERT-In within six hours of noticing them. The DPDP duty is to the Data Protection Board and to the people affected. One incident triggers both. A response plan should assign an owner to each clock.
How do I know if my own data was in a breach?
No Indian agency notifies individuals centrally. Under the DPDP Act the breached organisation must tell you. Until that is routine, check your email and phone number against breach-notification services, watch for password-reset emails you did not request, and treat any caller who knows your account details as a possible fraud. Our guide on checking for leaked data has the steps.
If you want help with this
- DPDP Act 2023 compliance · A practical path to compliance with the Digital Personal Data Protection Act 2023 and its rules, from gap assessment and consent design to breach notification planning and a DPO you can call.
- HR and data handling under the DPDP Act · training · A half-day session for HR, admin and anyone who handles employee or customer data on what the DPDP Act 2023 actually requires day to day, from consent and notices to retention and breach reporting.
Keep reading
Cyber Crime Statistics India: The Latest Official Numbers
Four official sources, four different things counted. The numbers that hold up, with their source and date, and the ones you should stop quo...
Data Breach Response Plan: Template for Indian Organisations
When customer data leaks, the first six hours decide the legal exposure and the next six days decide the reputational one. This template giv...
CERT-In Incident Reporting: Who Must Report, What, When
The six-hour rule is real, it applies to small companies, and most of them have never read it. Who must report, which incidents, how, and th...
How to Check If Your Data Was Leaked, and What to Do Next
Your email and phone number are almost certainly in a leaked database somewhere. That is a to-do list, not a crisis. How to find out what le...