Ransomware Statistics: India Versus the World

If you search for ransomware statistics India, you will find vendor charts claiming India is among the most attacked countries, a CERT-In incident count that looks small by comparison, and a global IC3 figure that counts something else again. None of them is wrong. They count different things in different units, and the job is to know which is which before comparing anything.

This post sets out what each Indian and international source measures, where to find the current figure in each report, and why a like-for-like India-versus-world comparison does not exist. We do not reproduce the counts; they change every year and the point is to send you to the table.

Ransomware statistics for India: what CERT-In counts

CERT-In is the national incident response agency under section 70B of the IT Act. Two of its publications matter. Its annual report carries a table of security incidents handled, by category, and ransomware is one of the categories. Separately, CERT-In has published an India Ransomware Report describing the sectors hit, the variants seen and the tactics observed in the period it covers. Both are on cert-in.org.in; MeitY's parliamentary replies on cyber incidents repeat the annual totals and can be searched on sansad.in.

What the CERT-In figure counts is incidents reported to it or detected by it. Since the directions of 28 April 2022, every service provider, intermediary, data centre and corporate body must report listed incidents, including ransomware, within six hours of noticing them, and keep logs for 180 days. In principle that makes the count more complete than before. In practice, compliance varies, small organisations often do not know the rule exists, and some incidents are handled quietly with an insurer and never reported. Treat the CERT-In count as the official floor. Our guide to CERT-In incident reporting explains who must report and how.

What is not published. No Indian agency publishes a national figure for ransoms paid, downtime cost or data stolen. Any such figure for India is from a vendor survey of the respondents who answered it. (Source: CERT-In annual reports; see cert-in.org.in.)

Which report measures what

Read the units column before the scope column. An incident count, a complaint count, a share of a sample and an average cost cannot be ranked against each other.

Why India versus the world is not a clean comparison

Different reporting rules

India's six-hour rule is unusual in its breadth and its deadline. The US has sector-specific rules and a voluntary complaint centre. The EU's NIS2 framework sets its own thresholds. A country with a strict rule and low compliance can show fewer incidents than a country with a voluntary system and a strong reporting culture.

Different victims counted

IC3 counts complaints from anyone, including individuals. CERT-In counts organisational incidents. The IOCTA describes groups rather than victims. Vendor surveys count whoever answered.

Different periods

CERT-In and IC3 use calendar years. IBM's report covers breaches in a window spanning two calendar years. Verizon's DBIR uses its own analysis period. "Last year" means four different things across the four reports.

The defensible comparison is qualitative, and it is consistent across every source: the same ransomware families, the same affiliate model, the same double extortion in which data is stolen before it is encrypted so that paying does not buy silence, and the same entry points of exposed remote access, unpatched edge devices and phished credentials. For India specifically, CERT-In and press reporting show the same sectors as everywhere else, with healthcare, manufacturing, education and local government prominent. The wider picture of breaches, not only ransomware, is in our post on data breach statistics for India.

The legal numbers that do not change with the statistics

Whatever the counts say, three obligations apply to every Indian organisation hit by ransomware. The CERT-In directions require a report within six hours. If personal data was accessed, the Digital Personal Data Protection Act, 2023 requires the Data Protection Board and affected individuals to be told under section 8(6), with penalties under the Act running up to ₹250 crore for failures of security safeguards. And the ransom demand itself is extortion under BNS section 308, which is why a police complaint belongs in the response even when nobody expects an arrest. These sections are quoted for orientation; verify at indiacode.nic.in. The full list for ransomware and breaches is on our ransomware and data breach page.

How to quote ransomware statistics India can stand behind

Done that way, ransomware statistics India publishes through CERT-In and the global reports from IC3, Europol, Verizon and IBM can sit in the same briefing without contradicting each other, because each is labelled with what it counts.

Using the statistics well

For a board, the useful lesson from every report is the same: ransomware is common, it enters through known weaknesses, and the cost is driven by downtime and data theft rather than the ransom. That argues for offline backups tested on a schedule, multi-factor authentication on email and remote access, and a rehearsed plan, which our ransomware playbook for Indian SMEs sets out step by step. For a company in the middle of an incident, the clock matters more than the chart: isolate, preserve logs, report to CERT-In within six hours, and call for help. Our incident response service handles the first hours, and the CERT-In explainer covers what the agency can and cannot do for you once the report is in.