Ransomware in India: who to report to, how fast and how to recover.

The facts

Who has to report a ransomware attack in India, and how fast?

Ransomware often shows itself as files that will not open or servers that will not start. From that moment, Indian rules can start several clocks, and each needs a named person to file.

The first clock is CERT-In’s, set by its Directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000¹. They apply to service providers, intermediaries, data centres, body corporates and government organisations¹.

Each must report listed incidents “within 6 hours of noticing such incidents or being brought to notice about such incidents”¹. Reports go to incident@cert-in.org.in, or by phone on 1800-11-4949¹.

Annexure I lists 20 incident types¹. Ransomware is named in item (v), malicious code attacks. Unauthorised access to IT systems or data is item (iii), and data breach and data leak are items (xi) and (xii)¹.

CERT-In’s FAQ uses the IT Act’s definition of “body corporate”: “any company”, including a firm or a sole proprietorship².

The facts

When does the six-hour clock start, and what if you know little?

The clock runs from noticing. The FAQ repeats the words: within 6 hours “of noticing the incident or being brought to notice about such incident”². Neither text ties the clock to the end of an investigation¹².

You do not need the full picture to file. Entities “may provide information to the extent available at the time of reporting”, and more “may be reported later within reasonable time”².

Question 13 of the FAQ asks whether a business and its outsourcing partner can agree by contract who reports². CERT-In’s answer is that any entity which notices the incident shall report it, and the obligation “is neither transferrable nor indemnified or dispense with”². The FAQ adds that it is not a legal document².

The Directions also require logs of all ICT systems, kept for a rolling 180 days within Indian jurisdiction and given to CERT-In with the report¹. System clocks must sync to National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers, or ones traceable to them¹. Each organisation names a Point of Contact for CERT-In¹.

The facts

Which sector regulators and other rules add a clock?

Regulated firms file more than once. The table uses each instrument’s own trigger where it gives one.

IRDAI’s 2026 Guidelines, issued on 6 April 2026, also ask for ICT logs kept for 180 days in India⁴. SEBI’s portal takes reports in stages, from initial to final⁵.

RBI’s Directions of 31 July 2026 repealed its earlier IT directions for banks and NBFCs⁶⁷. The NBFC version keeps housing finance companies reporting to NHB rather than RBI⁷.

The Board’s 72-hour report has six parts, from updated details of the breach to a report on the notices given to affected people³.

A listed company may also owe the stock exchanges a disclosure. After a ransomware incident on 23 June 2026, Bajaj Auto reported to CERT-In and informed the exchanges⁸. It called the disclosure a matter of good governance⁸.

The facts

How do ransomware attacks on Indian organisations start and end?

The India figures come from Sophos’s State of Ransomware survey: 240 IT and security leaders whose organisations were hit in the past year⁹. The organisations had 100 to 5,000 employees, and the survey ran from January to March 2026⁹.

Email led the technical root causes: malicious email in 28% of attacks and phishing in 26%⁹. Compromised credentials came next at 19%, and exploited vulnerabilities fell to 11%, from 29% a year earlier⁹. Asked about identity, 79% confirmed the ransomware incident was the same event as their most significant identity attack⁹.

Where stolen credentials were the way in, MFA was usually in place. Across the global survey, 97% of victims whose attack began with compromised credentials had MFA enabled “in some capacity”¹⁰. One-time passwords (52%), push apps (51%) and passkeys (51%) were the most common methods¹⁰. Sophos suggests MFA may have been missing from some systems, and is not enough on its own¹⁰.

In Rapid7’s global incident response investigations in 2025, valid accounts with missing or lax MFA were the most common way in, at 43.9%¹¹. Ransomware was involved in 42% of those investigations¹¹.

Data was encrypted in 60% of Indian attacks⁹. Where it was, 67% used backups to recover it and 56% paid the ransom and got data back⁹. Some did both. Within a week, 58% had recovered; 10% took one to six months⁹. Mean recovery cost, excluding any ransom, was US$1.11 million⁹.

What it means

What does this change in the first six hours?

The first six hours hold two jobs: the CERT-In report and the start of recovery. Neither can wait for the other.

Filing starts when someone matches what they see to a type in Annexure I¹. That person needs the authority to file without calling a meeting. The FAQ allows a short first report, so there is no need to wait for forensics².

Outsourcing does not move the duty. If your service provider or SOC notices the attack first, the FAQ expects whoever notices to report². Your contract should say how fast they tell you, so half your six hours are not gone before you hear.

Logs decide what the report can say. The Directions ask for 180 days of them in India, on synchronised clocks¹. Firewall, VPN, identity and server logs that are missing or out of step leave holes in the timeline. From 13 May 2027, Rules 6(1)(e) and 8(3) require at least a year of logs for personal data processing³.

In the credential cases, having MFA was not enough¹⁰. CISA’s Scattered Spider advisory, AA23-320A, describes repeated push prompts until someone pressed Accept, and calls asking help desks to reset passwords or transfer MFA tokens¹². It recommends FIDO/WebAuthn or PKI-based MFA, which resists phishing, push bombing and SIM swaps¹².

After the report, recovery time sets the cost. Tata-owned Jaguar Land Rover shut production for nearly six weeks after its 2025 attack¹³. The independent Cyber Monitoring Centre put the loss to the UK economy at £1.9 billion, across more than 5,000 organisations¹³. Most of it was lost manufacturing output¹³.

From 13 May 2027, DPDP Rule 6(1)(d) names data backups as a measure for continued processing³. CERT-In’s blueprint of 25 May 2026, CISG-2026-02, is more specific: it lists immutable backups, restoration testing and isolated backup infrastructure among its controls¹⁴. It says organisations should run backup restoration validation alongside incident response and table-top exercises¹⁴.

What it means

What should be in place before the next incident?

Each step below leaves something you can show an auditor or a regulator.

1. Name the person who decides an event is reportable and has the authority to file, plus a deputy for nights and leave.
2. Write the decision rule against the 20 types in Annexure I, so the call is a lookup¹.
3. Put incident@cert-in.org.in, 1800-11-4949, your sector regulator’s route and a short report template in the runbook¹.
4. Send CERT-In your Point of Contact in the Annexure II format, and update it when people change¹.
5. List every log source: firewall, VPN, identity, email, servers, endpoints and cloud. Confirm each keeps 180 days in India¹. From 13 May 2027, keep logs of personal data processing for at least a year³.
6. Point every clock at NIC or NPL time, and check for drift¹.
7. Ask each provider that could notice an attack first how fast they will tell you, in writing².
8. Move administrators and remote access to FIDO/WebAuthn or PKI-based MFA first¹². Require a call-back to a known number before the help desk resets a password or an MFA device.
9. Each quarter, restore one critical system from backup into an isolated network. Record the date, the time taken, what was missing and who owns each gap.
10. Rehearse the clock sheet below twice a year with the people named on it.

Our view

Where would we put the effort first?

Limits

What does this article not cover?

Where we fit

Who can check your six-hour readiness?

Our managed SOC and MDR service is built around these duties: logs kept in India, NIC or NPL time on every source and a runbook naming who reports what. Monitoring and response run in the windows agreed in writing. The SOC readiness review checks your log sources, retention and 6-hour reporting readiness. It is free, and the written findings are yours whether we work together or not.