Ransomware Attack in India 2026: What To Do

Ransomware is malicious software that locks or encrypts the files on your computer or phone and then demands a payment, usually in cryptocurrency, to get them back. It reaches ordinary Indians and small businesses through everyday channels: phishing emails with infected attachments or links, pirated or cracked software and activators downloaded from unofficial sites, fake apps sideloaded outside the Google Play Store or Apple App Store, malicious ads, and weakly protected remote-access setups on shop or office computers. CERT-In, India's national computer emergency response team, has flagged a rise in ransomware hitting internet-exposed database servers and network storage devices, which small firms often run without patching. You do not need to be a large company to be a target. Attackers scan the internet automatically and hit whatever is exposed. A single click on a fake invoice, resume, or delivery notice is often all it takes for the encryption to begin spreading across a device and any drives connected to it.

No, do not pay if you can avoid it. Both CERT-In in India and the FBI in the United States advise victims not to pay, because payment does not guarantee you will get your files back and it funds more attacks. In many documented cases, victims who paid were never sent a working decryption key, or were sent one that only partially worked, or were extorted a second time. Paying also marks you as someone who pays, which invites repeat targeting. Before even considering payment, disconnect the device, preserve the ransom note, and check the free No More Ransom project run by Europol to see whether a free decryptor already exists for your ransomware strain. Report the incident to the 1930 cybercrime helpline and at cybercrime.gov.in. If a business is involved and the data loss is severe, take legal and professional advice before making any decision, but understand that payment is a gamble with a criminal, not a purchase with a guarantee.

Move fast and stay calm. First, disconnect the infected device from the internet and from any office network by unplugging the network cable and turning off Wi-Fi, so the ransomware cannot spread to other machines or shared drives. Do not shut the computer down if you can avoid it, as some evidence and recovery options live in memory. Second, do not pay anything and do not delete the ransom note or the encrypted files, since they are needed to identify the strain. Third, photograph the ransom message and note the exact time. Fourth, disconnect any external hard drives, USB sticks, and backups that were not already attached, so a clean backup survives. Fifth, isolate other computers on the same network and check them. Sixth, report to the 1930 helpline and file at cybercrime.gov.in, and if you are an organisation, report to CERT-In. Speed limits the spread and improves your reporting position. The first hour decides how much you save.

Often yes, and you should always check before paying anything. The No More Ransom project, run by Europol, the Dutch National Police, and security firms including Kaspersky, offers more than 130 free decryption tools covering many known ransomware families. Go to nomoreransom.org, use the Crypto Sheriff tool to upload the ransom note or a sample encrypted file, and it will tell you whether a free decryptor exists for your strain. The portal works from India and is available in dozens of languages. If a tool exists, it comes with step-by-step instructions to recover your files at no cost. If no tool is available yet, keep a copy of the encrypted files, because researchers release new decryptors regularly and one may appear for your strain later. Do not delete the encrypted data assuming it is lost forever. Free recovery is not guaranteed for every strain, but checking No More Ransom is free, safe, and often successful, and it costs a criminal nothing when you skip the ransom.

The most common routes are phishing, pirated software, and fake apps. Phishing means an email, SMS, or WhatsApp message with an infected attachment or a link to a malicious file, often disguised as an invoice, job offer, courier update, or bank notice. Pirated or cracked software, including cracked Windows, Office, Photoshop, or games downloaded from torrent and unofficial sites, frequently bundles ransomware or the loaders that install it. Fake apps sideloaded from outside the Google Play Store or Apple App Store, especially fake banking, loan, or utility apps, can carry mobile ransomware or spyware. Other routes include malicious online ads, infected USB drives passed between machines, and weakly secured remote-desktop or database services that attackers brute-force. CERT-In has specifically warned about ransomware groups exploiting internet-exposed database servers and network storage. On phones, Android is more exposed than iPhone because Android allows sideloading. The single most protective habit is to install software and apps only from official sources and never open unexpected attachments.

For individuals and small businesses, call the 1930 national cybercrime helpline, operated 24x7 by the Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs, and file a formal complaint at cybercrime.gov.in as soon as possible. Provide the ransom note, the time of the attack, any suspicious email or message that preceded it, and details of any payment demanded. If money was already sent to the attacker, report that too, because fast reporting can sometimes help trace or freeze accounts. Registered companies and critical infrastructure operators have an additional obligation: CERT-In directions under Section 70B of the Information Technology Act require organisations to report cyber incidents, including ransomware, to CERT-In within six hours of noticing them, by email to incident@cert-in.org.in. Reporting does not cost anything and it builds the national picture that helps authorities disrupt these groups. Keep the acknowledgement number from cybercrime.gov.in, as banks, insurers, and police may ask for it during any follow-up.

No. Paying a ransom is not a purchase with a warranty, it is a payment to a criminal who has already lied to you. The FBI states that in its experience some victims who paid were never given the promised decryption key, and that payment does not stop stolen data from being leaked later. Many ransomware groups now run double extortion: they encrypt your files and also copy your data before locking it, then threaten to publish it whether or not you pay. So even a victim who pays and recovers their files can still have their customer records, financial data, or personal photos leaked. Decryption tools supplied by attackers are also often slow, buggy, or incomplete, and can corrupt data. On top of all this, paying funds the next wave of attacks and marks you as a paying target. This is why CERT-In and the FBI both advise against paying and recommend recovery from clean backups plus free tools where available.

Small businesses in India are frequent ransomware targets because they hold valuable data but often lack basic defences. The core measures, drawn from CERT-In and Cyber Swachhta Kendra guidance, are practical and mostly free. Keep regular offline or disconnected backups of critical data and test that you can actually restore them, because a backup you never tested may fail when you need it. Apply software and operating-system updates promptly, since ransomware often exploits known unpatched flaws. Enforce strong, unique passwords and turn on multi-factor authentication for email, accounting, and admin accounts. Restrict who can install software and access shared drives using role-based permissions. Do not expose database servers, remote desktop, or network storage directly to the internet without protection. Train staff to spot phishing and to avoid pirated software. Use reputable antivirus and keep it updated. None of these steps require a big budget, and together they stop the vast majority of attacks.

The backups that survive a ransomware attack are the ones the ransomware cannot reach. Follow the widely recommended 3-2-1 approach: keep at least three copies of important data, on two different types of media, with one copy kept offline or offsite. The offline copy is the one that saves you, because ransomware encrypts everything it can touch, including connected external drives and always-on network storage and, in some cases, cloud drives that sync automatically. An external hard drive that you plug in only during backup and then unplug, or a cloud backup service with versioning that lets you roll back to a pre-attack state, both give you a clean copy to restore from. Test your restore process at least a few times a year, because an untested backup is a hope, not a plan. For a small business, this can be as simple as a rotated set of external drives kept in a drawer plus a versioned cloud backup. For individuals, it can be a monthly copy of photos and documents to a drive you keep disconnected. Backups turn a ransomware disaster into an inconvenience.

Yes. Android phones can be hit by mobile ransomware, and India sees this more than iPhone because Android lets users install apps from outside the official store. Mobile ransomware typically arrives as a fake app: a fake loan app, a fake banking or KYC app, a cracked paid app, a fake video player, or an app promoted through a link in SMS or WhatsApp. Once installed and granted permissions, it can lock the screen and demand payment, or in some cases encrypt files on the phone. The strongest defences are simple. Install apps only from the Google Play Store, and do not sideload APK files sent by strangers or downloaded from unofficial sites. Do not grant accessibility, admin, or file permissions to apps that have no reason to need them. Keep Android updated and keep Google Play Protect enabled. Be especially wary of loan and reward apps promising instant money, which are a common cover for malware in India. If your phone is locked by ransomware, do not pay. Report at cybercrime.gov.in and seek help to safely reset the device.

Possibly, and this is the part many people miss. Backups protect you from losing access to your files, but they do not undo theft. Many modern ransomware groups use double extortion: before they encrypt your files, they quietly copy your data out, then threaten to publish or sell it unless you pay, even if you can restore everything from backup. So a business with perfect backups can still face a leak of customer records, employee data, or financial information. This is why prevention matters as much as recovery, and why a ransomware attack that touches personal data may also trigger obligations under India's Digital Personal Data Protection framework and require notifying affected people and authorities. If you suspect data was stolen as well as encrypted, treat it as a data breach, not just an outage: report to CERT-In and cybercrime.gov.in, preserve evidence, take legal advice, and be honest with anyone whose data was exposed. Backups keep your business running. Only good security keeps your data from being taken in the first place.