Type of cyber crime
Ransomware & data breaches
Attacks on organisations that encrypt systems for ransom or steal customer and employee data, with legal duties to report.
Ransomware groups now steal data before encrypting it, so paying no longer buys silence. Indian organisations of every size are hit, from hospitals to municipal corporations to small manufacturers. CERT-In requires incident reporting within six hours, and the DPDP Act adds breach notification to affected people and the Data Protection Board.
How it usually looks
- A logistics company's ERP encrypted on a Friday night; backups on the same server.
- Customer KYC documents from a lender listed on a leak site.
- A school's ERP credentials sold, student data used for targeted scams.
Law that applies
| Provision | What it covers | Punishment |
|---|---|---|
| IT Act 2000 s.43 / s.66 | Unauthorised access, damage, denial of access | Compensation; up to 3 years |
| IT Act 2000 s.70B + CERT-In Directions 2022 | Mandatory incident reporting within 6 hours; 180-day logs | Up to 1 year and/or fine for non-compliance |
| DPDP Act 2023 s.8(6) | Breach notification to the Board and affected data principals | Penalty up to ₹250 crore |
| BNS 2023 s.308 | Extortion (the ransom demand) | Up to 7 years |
Sections are quoted for orientation; the police decide the final charge sheet. Verify text at indiacode.nic.in.
Where to report
- Isolate affected systems; preserve logs; do not wipe.
- Report to CERT-In (incident@cert-in.org.in, 1800-11-4949) within six hours.
- File on cybercrime.gov.in and with the local cyber police; inform your insurer.
- If personal data is involved, prepare DPDP breach notifications.
How to prevent it
- Offline or immutable backups, tested quarterly.
- MFA on email, VPN and admin accounts; patching of internet-facing systems.
- Network segmentation between office, servers and plant/clinical systems.
Frequently asked questions
Should we pay the ransom?
Paying is legal in India but funds crime, rarely restores everything, and does not stop data from being leaked. Decide with legal counsel and your insurer, after containment, never on the attacker's clock.