Introduction
The rapid growth of digital technology has also led to a significant growth in cybercrime. As people, businesses and governments increasingly depend on the internet and digital services, cybercriminals have developed more sophisticated methods of attack. Cybercrime has evolved from basic hacking and online fraud to threats such as AI-based attacks and data breaches. The targets have also expanded from individuals to businesses, governments and critical infrastructure.1 Among these threats, ransomware has emerged as a particularly serious form of cybercrime. Ransomware is a type of cyberattack in which the attacker gains unauthorised access to a computer system or network, restricts access to the victim’s data, encrypts it and demands money in return for restoring access. A report by the European Union Agency for Cybersecurity (ENISA), which studied 623 ransomware incidents between May 2021 and June 2022, found that ransomware “has adapted and evolved, becoming more efficient and causing more devastating attacks”, and that it is “targeting all sectors indiscriminately”.2
Ransomware attacks have evolved beyond simply encrypting data and demanding payment. Attackers now go further by stealing sensitive data and threatening to publish it if the ransom is not paid. These developments have given rise to different forms of extortion, including single, double and triple extortion, showing that ransomware is no longer limited to encrypting data.3 As a result, a ransomware attack is not one simple act. It consists of multiple forms of conduct involving unauthorised access, data encryption or locking, data theft and ransom demands.
Although there is no separate legislation in India that specifically deals with ransomware attacks, the conduct involved in such attacks may fall within India’s existing cyber laws, particularly the Information Technology Act, 2000 (hereinafter the IT Act) and the Bharatiya Nyaya Sanhita, 2023 (hereinafter the BNS). However, ransomware creates practical difficulties, such as identifying attackers, cross-border issues and tracing cryptocurrency ransom payments, which make such attacks more complex. This raises an important legal question: whether the existing provisions of Indian law can, through statutory interpretation, adequately cover the different forms of conduct involved in a ransomware attack. The present study therefore examines the extent to which existing Indian legal provisions can be applied to the different forms of conduct involved in ransomware attacks. It is a doctrinal study of the existing Indian legal framework, particularly the IT Act, 2000 and the BNS, 2023, the judicial decisions interpreting them and the principles of statutory interpretation, and it also undertakes a comparative study of the United States to examine the Indian legal position.
A. Statement of the problem
Indian law does not contain a separate provision specifically dealing with ransomware. Existing laws may apply to different aspects of ransomware-related conduct, but questions remain about the extent to which these provisions can adequately address the forms that ransomware attacks take. The absence of a specific legal provision therefore creates a need to examine how far the existing Indian legal framework can be applied to ransomware-related conduct through statutory interpretation. This study examines the existing legal provisions relating to ransomware attacks and assesses their adequacy in addressing the conduct associated with such attacks.
B. Significance
The study is significant because ransomware attacks involve evolving and multiple forms of conduct, while Indian law addresses such conduct through existing legal provisions rather than through a separate ransomware-specific offence. The study therefore helps examine how far these provisions can be applied to different ransomware conduct and where questions of statutory interpretation arise. It also examines whether the existing Indian legal framework is adequate once the relevant provisions are applied and interpreted. The comparative analysis further provides a basis for understanding ransomware and assists in evaluating the Indian legal position.
Literature review
1. Manuj Aggarwal, “Ransomware Attack: An Evolving Targeted Threat” (2023).4 The study examines the changing nature of ransomware attacks, including double and triple extortion, Ransomware-as-a-Service, ransomware groups, detection techniques and preventive measures. However, it focuses primarily on the technical evolution and cybersecurity aspects of ransomware and does not examine the legal implications of these changing forms of attack under Indian law. In particular, it does not assess whether emerging practices such as data exfiltration, multiple forms of extortion and targeted attacks create difficulties in applying existing Indian legal provisions. The present study addresses this gap by examining the legal challenges created by the evolving nature of ransomware and assessing the adequacy of the existing Indian legal framework in responding to these changing forms of attack.
2. Amanasubramanian and Sadhana Sai Bhaskar, “Multijurisdictional Approaches to Combating Ransomware” (2024).5 The study examines ransomware from a multijurisdictional perspective, focusing on digital forensics, cross-border investigation, international cooperation and India’s existing legal framework. It highlights challenges such as data encryption, jurisdictional issues, digital evidence, limited law-enforcement resources and weaknesses in the existing legal response. However, it mainly identifies these weaknesses without examining in detail how existing legal provisions can be applied to the different forms of conduct involved in ransomware attacks. The present study addresses this gap by examining the application and adequacy of existing Indian legal provisions to different ransomware conduct.
3. Amit Yadav, Pankaj Kumar, Arpit Totuka, Deepankar Sharma and Paridhi Jain, “Cyber Extortion Revealed: An Analysis of Ransomware’s Development, Strategies, Obstacles, and Prospects for the Future” (2024).6 The study examines the development of ransomware, including techniques such as phishing, data theft, encryption, Ransomware-as-a-Service and double extortion. It also discusses challenges such as cryptocurrency payments, and measures for prevention, detection and incident response. However, it focuses primarily on the technical aspects and prevention of ransomware and does not examine in detail whether existing legal frameworks are sufficient to address these modern forms of ransomware. The present study therefore focuses on the legal aspects arising from evolving ransomware practices and examines the adequacy of the existing Indian legal framework in addressing them.
4. P. Priya Raghavendra, “Legal Framework for Combatting Ransomware Attacks – Policies and Recommendations” (2025).7 The author examines the existing legal and policy framework for addressing ransomware attacks in India and identifies provisions of the IT Act, 2000, the Indian Penal Code, 1860 and international frameworks, along with practical challenges. The paper primarily evaluates the adequacy and effectiveness of the existing legal framework and suggests measures to strengthen legislation, law enforcement, cybersecurity and international cooperation. However, it does not undertake a detailed examination of whether ransomware attacks can be brought within the scope of existing Indian laws through appropriate statutory interpretation. The present study therefore seeks to address this gap by applying existing Indian provisions to ransomware attacks and determining whether their scope can accommodate ransomware-related activities through interpretation, without relying primarily on the creation of a separate ransomware-specific offence.
5. Ashima Sarin, “Ransomware Attacks and India’s Cyber Legal Framework: Are Existing Laws Adequate to Combat Digital Extortion?” (2026).8 The author examines the growing threat of ransomware in India and evaluates whether the existing legal framework can address the different activities involved in ransomware attacks. The paper discusses the IT Act, 2000, the BNS, 2023, the CERT-In Directions and the Digital Personal Data Protection Act, 2023, along with relevant judicial decisions on electronic evidence. It also highlights practical difficulties such as cross-border attacks, cryptocurrency payments, cyber-forensic challenges, delayed reporting and lack of coordination among authorities. However, while the paper identifies the existing provisions that may apply to ransomware and discusses the difficulties of enforcing them, it does not analyse in detail how specific ransomware conduct can be brought within the scope of particular statutory provisions. The present study undertakes that conduct-by-conduct analysis: it takes in turn unauthorised access, encryption, denial of access, data exfiltration, the ransom demand and cross-border conduct, and asks in each case which provision of the IT Act or the BNS applies and how its terms should be read.
Nature and development of ransomware
A. Meaning of ransomware
Ransomware is a form of malicious software that unlawfully restricts access to a victim’s computer system, network or data, usually by encrypting files or disabling the affected device. Once access has been blocked, the attacker demands a ransom in return for a decryption key or the restoration of the compromised system. The attackers may also threaten to disclose or publish the victim’s information if the ransom is not paid.9
B. Process of ransomware
1. Initial access: The attacker gains access to the victim’s computer or network, commonly through phishing emails, malicious attachments or links, or software vulnerabilities. After entering the system, the ransomware establishes control.10
2. Data encryption: The ransomware identifies and encrypts important files, making them inaccessible to the victim. In some attacks, the attacker also copies or steals the data before encryption.11
3. Ransom demand: The attacker demands money to restore access or to provide a decryption key. The attacker may also set a deadline and threaten to destroy the decryption key or to publish the data if the ransom is not paid.12
4. Payment and decryption: The victim may choose to pay the ransom, usually in cryptocurrency. The attacker verifies the payment and may provide a decryption key, but payment does not guarantee that the files will be restored.13
5. Recovery: After the attack, the victim may recover the data using a decryption key, backups or other recovery methods.
C. Types of ransomware
1. Crypto ransomware: Also known as encrypting ransomware, this is a common type of ransomware. It operates by encrypting the victim’s files and data, making them inaccessible.14 The attacker then demands a ransom in cryptocurrency, promising to provide a decryption key to restore the files once the ransom is paid.15
2. Locker ransomware: Also known as a screen locker. Rather than encrypting the files, it prevents victims from accessing their files or data until the ransom is paid.16
3. Scareware: This is a fake virus warning that frightens users into paying for unnecessary or fake antivirus software. It may also trick them into downloading malware or revealing personal information.17
4. Doxware: The attackers steal sensitive data and threaten to publish it unless the ransom is paid.18 This added threat is called double extortion because the attackers both encrypt the victim’s files and threaten to leak the stolen information.19
5. Ransomware-as-a-Service (RaaS): In this model, the developers rent ransomware tools to other hackers, called affiliates.20 The affiliates then conduct attacks and share the ransom payments with the developers.21
D. Evolution of ransomware
i. Early ransomware: the AIDS Trojan (1989)
The AIDS Trojan was created by Dr Joseph Popp in 1989 and is considered the first recognised ransomware. It was distributed on 20,000 floppy disks. After the computer had been restarted 90 times, it encrypted the file names and made the files inaccessible. The victim was then asked to pay $189 to restore access.22 The early ransomware was technically unsophisticated, and victims could often bypass it using basic recovery tools.23
ii. Rise of modern ransomware (2004–2013)
Ransomware returned stronger some 15 years after the 1989 incident, with more advanced techniques. GpCode (2004) used RSA encryption, so that users could not easily decrypt the locked files without paying. Archiveus (2006) used strong encryption and showed that ransomware was becoming technically advanced.24 However, collecting the ransom was difficult because cryptocurrency was not yet widely available.25 CryptoLocker (2013) combined strong encryption with Bitcoin for ransom payments.26
iii. Ransomware-as-a-Service (2016)
Ransomware-as-a-Service is a business model in which the developers rent ransomware tools to other hackers, called affiliates.27 Tox (2015) was a RaaS platform that made it easy to mount ransomware attacks while the developers received a share of the ransom. Cerber (2016) was another RaaS platform, which used strong encryption and was delivered through emails, phishing and exploit kits.28
iv. Double and triple extortion (2019–present)
In double extortion, the attacker not only encrypts the data but also steals or copies sensitive data and threatens to release or sell it if the ransom is not paid,29 whereas triple extortion combines data encryption and data theft with additional pressure tactics, such as contacting the victim’s customers or launching a DDoS attack to disrupt the organisation.30
E. Impact of ransomware
The targets of ransomware have expanded from individual computers to organisations, institutions and government departments. These attacks can cause serious harm, including data loss, financial loss, disruption of operations, data breaches, reputational damage and threats to national security. Paying the ransom does not guarantee the recovery of the encrypted data.31
F. Ransomware incidents in India
• All India Institute of Medical Sciences (AIIMS), New Delhi: On 23 November 2022, a ransomware attack corrupted the AIIMS servers holding its e-Hospital database and laboratory information system, including patient registration and laboratory records. The hospital had to run its outpatient, inpatient and laboratory services manually for more than a week. Hackers reportedly demanded about ₹200 crore in cryptocurrency, although the Delhi Police stated that no ransom demand had been brought to its notice. The Delhi Police registered a case of extortion and cyber terrorism under Section 385 of the Indian Penal Code, 1860 and Section 66F of the IT Act.32
• WannaCry ransomware attack, 2017: In May 2017, WannaCry encrypted files and spread automatically by exploiting a vulnerability in older, unpatched versions of Microsoft Windows. It affected more than 200,000 computers in over 150 countries. In India, infections were reported in the computers of 18 Andhra Pradesh police units, in offices of the West Bengal State Electricity Distribution Company in West Midnapore district, and in two village panchayat offices in Kerala.33
• Homi Bhabha Cancer Hospital and Research Centre, New Chandigarh: On 2 December 2024, an Interlock ransomware incident disrupted the hospital’s IT systems; computers stopped functioning and a message warned that the network had been infiltrated, files encrypted and sensitive information taken. The IT department escalated the matter to the authorities the same day, and about 95 per cent of IT services had been restored by 12 December 2024. A later audit by the Comptroller and Auditor General found that no root-cause analysis had been carried out.34
• Bajaj Auto: In June 2026, Bajaj Auto disclosed in a regulatory filing that a ransomware incident had affected its systems and those of its subsidiary, Bajaj Auto Technology Limited. The company said that it had taken precautionary measures to contain the impact, that its technical team and cybersecurity experts had responded immediately, and that its mitigation efforts had so far been successful.35
G. Challenges in addressing ransomware attacks
i. Anonymity of attackers
Identifying the people behind a ransomware attack is a major challenge. Attackers may use VPNs, false identities and dark-web services to hide their identity and location. In RaaS operations, moreover, the malware is developed by one group and rented to another. As a result, investigators find it difficult to identify the person ultimately behind the attack.36
ii. Cross-border nature of ransomware
Ransomware attacks often cross national borders. Attackers may operate from one country and attack a victim in another. This creates difficulties in determining which country’s laws apply.37 Investigators also face difficulties in identifying perpetrators, gathering evidence and prosecuting offenders, not least because “[a]ttackers may launch attacks from countries with weak cybercrime laws or limited international cooperation”.38
iii. Cryptocurrency and ransom payments
Cryptocurrency transactions generally do not reveal the real-world identity of the persons involved, which makes it difficult to trace ransom payments and identify the persons who receive them. This has allowed ransomware attackers to maximise profits while minimising the likelihood of detection.39
iv. Victim cooperation
When an attacker demands a ransom, the victim may fail to report the attack for fear that its sensitive information will be published, or of regulatory consequences, and may feel pressured to pay. Limited cooperation from victims therefore hinders investigation and is a major challenge.40
v. Changing forms of ransomware
The evolution of ransomware from simple attacks into more complex forms involving double and triple extortion, RaaS and data theft increases the pressure on victims and makes the attackers more difficult to identify.41
Existing Indian legal framework relating to ransomware attacks
A. Information Technology Act, 2000
Section 43 provides for penalty and compensation for damage to a computer, computer system, computer network or computer resource.42 It applies when a person, without the permission of the owner or the person in charge, accesses or secures access; downloads, copies or extracts data or information; introduces a computer contaminant or computer virus; damages; disrupts; denies access to an authorised person; assists another person to obtain unauthorised access; charges the services availed of by one person to another person’s account by tampering with or manipulating a computer; destroys, deletes or alters information, diminishes its value or utility or affects it injuriously; or steals, conceals, destroys or alters any computer source code used for a computer resource with an intention to cause damage. A person committing any of these acts is liable to pay damages by way of compensation to the person affected.
Section 66 provides that when a person dishonestly or fraudulently does any act referred to in Section 43, the person is punishable with imprisonment for up to three years, or with a fine of up to ₹5 lakh, or with both.43
Section 66D provides that a person who, by means of a communication device or computer resource, cheats by personation is punishable with imprisonment for up to three years and is also liable to a fine of up to ₹1 lakh.44
Section 66F deals with cyber terrorism. It applies when a person, with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people, denies access to an authorised user, penetrates or accesses a computer resource without authorisation, or introduces a computer contaminant, and by such conduct causes or is likely to cause death or injury, damage to or destruction of property, or disruption of supplies or services essential to the life of the community, or adversely affects critical information infrastructure specified under Section 70. It also covers knowingly or intentionally accessing, without authorisation, information restricted for reasons of the security of the State or foreign relations, with reason to believe that the information may be used to injure the sovereignty and integrity of India, the security of the State or public order, among other interests. A person who commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life.45
Section 75 provides that the Act applies to offences or contraventions committed outside India by any person, irrespective of nationality, where the act or conduct constituting the offence or contravention involves a computer, computer system or computer network located in India.46
B. Bharatiya Nyaya Sanhita, 2023
Section 308 deals with extortion. A person commits extortion who intentionally puts another person in fear of injury and thereby dishonestly induces that person to deliver property, a valuable security, or anything signed or sealed that may be converted into a valuable security; the punishment is imprisonment for up to seven years, or a fine, or both. A person who, in order to commit extortion, puts or attempts to put another in fear of injury is punishable with imprisonment for up to two years, or a fine, or both. Putting or attempting to put a person in fear of death or grievous hurt in order to commit extortion is punishable with imprisonment for up to seven years and a fine, and committing extortion by putting a person in fear of death or grievous hurt with imprisonment for up to ten years and a fine. Putting or attempting to put a person in fear of an accusation of having committed or attempted to commit certain serious offences, in order to commit extortion, is punishable with imprisonment for up to ten years and a fine.47
Section 318 deals with cheating. A person who deceives another and fraudulently or dishonestly induces that person to deliver property or to consent to another retaining property, or intentionally induces that person to do or omit to do something that causes or is likely to cause harm to that person in body, mind, reputation or property, is punishable with imprisonment for up to three years, or a fine, or both. A person who cheats knowing that wrongful loss is likely to be caused to a person whose interest he was bound by law or contract to protect is punishable with imprisonment for up to five years, or a fine, or both. A person who cheats and thereby dishonestly induces the person deceived to deliver property, or to make, alter or destroy a valuable security or anything signed or sealed that is capable of being converted into a valuable security, is punishable with imprisonment for up to seven years and a fine.48
Section 324 deals with mischief. A person who, with intent to cause, or knowing that he is likely to cause, wrongful loss or damage to any person, destroys any property or causes such change in it as destroys or diminishes its value or utility, is punishable with imprisonment for up to six months, or a fine, or both.49
Section 351 deals with criminal intimidation. A person who threatens another with injury to his person, reputation or property, with intent to cause alarm or to compel him to do an act that he is not legally bound to do, or to omit an act that he is legally entitled to do, is punishable with imprisonment for up to two years, or a fine, or both. An additional punishment of up to two years applies where the threat is made by anonymous communication or where the person making the threat takes precautions to conceal his name or abode.50
India does not have a standalone statute dealing exclusively with ransomware attacks. The multiple forms of conduct involved in a ransomware attack must therefore be examined within the scope of existing legal provisions. By applying these provisions to each form of conduct, statutory interpretation is used to determine the extent to which such conduct can be brought within the existing legal framework.
Application and interpretation of existing laws to ransomware conduct
A. Unauthorised access to the victim’s computer system
Conduct: The attacker first gains unauthorised access to the victim’s computer system. Access may be obtained through phishing emails, malicious attachments, the exploitation of software vulnerabilities or stolen credentials. Such access enables the attacker to introduce ransomware and carry out further activities.
Application: Section 43(a) addresses accessing or securing access to a computer without the permission of the owner or the person in charge.51 Section 2(1)(a) defines “access” as gaining entry into, instructing or communicating with the logical, arithmetical or memory function resources of a computer, computer system or computer network.52
Section 66 applies when a person dishonestly or fraudulently does an act referred to in Section 43. Under Section 2(7) of the BNS, “dishonestly” means doing anything with the intention of causing wrongful gain to one person or wrongful loss to another.53 Under Section 2(9), “fraudulently” means doing anything with the intention to defraud, but not otherwise.54
Where initial access is obtained through a phishing email in which the attacker pretends to be another person or a trusted organisation, the conduct may also amount to cheating by personation by means of a communication device or computer resource under Section 66D of the IT Act.55 It may likewise amount to cheating under Section 318(1) of the BNS, since the victim is deceived into doing something, such as opening a malicious attachment or disclosing credentials, which he would not otherwise do and which causes or is likely to cause harm to his property.56
Interpretation: The provision turns on two elements: access to a computer and the absence of permission. The attacker enters and accesses the victim’s computer system without the permission of the owner. The words “accesses or secures access” in Section 43(a) are therefore broad enough to cover both directly entering the system and obtaining access by other means. In Gagan Harsh Sharma v. State of Maharashtra, the Bombay High Court treated the alleged access to, and copying of, an employer’s data and software without permission as conduct falling within Sections 43 and 66 of the IT Act.57
Section 66 applies where a person “dishonestly or fraudulently” does an act referred to in Section 43. The attacker’s deliberate access to a victim’s system in order to encrypt files and demand payment may provide evidence of an intention to cause wrongful gain and wrongful loss. Section 66 therefore provides an existing legal basis for addressing the criminal nature of unauthorised access in ransomware attacks.
B. Encryption or alteration of data
Conduct: The attacker introduces ransomware and may encrypt, modify or tamper with the original information stored in the victim’s computer system. Encryption transforms readable data into an unreadable form, and access to the data then requires a decryption key, which the attacker makes available only after the ransom is paid.58
Application: Section 43(c) deals with introducing a computer contaminant or computer virus into a computer system.59 The attacker introduces ransomware to take control of the legitimate user’s data.
Section 43(d) deals with damaging a computer, computer system, computer network or the data residing in it.60 When ransomware is introduced, it may damage the victim’s files, data and information.
Section 43(i) addresses information residing in a computer resource that is destroyed, deleted or altered, or whose value or utility is diminished.61 While accessing the computer, the attacker may destroy or alter important data or information, or diminish its value or utility.
Section 324 of the BNS may also apply, since encryption causes such change in the victim’s data as destroys or diminishes its value or utility, or affects it injuriously, provided that the data is treated as “property” for this purpose. The punishment for mischief is graded by the loss caused: where the loss or damage amounts to one lakh rupees or more, the offence is punishable with imprisonment for up to five years.62
Interpretation: Clauses (i) and (iii) of the Explanation to Section 43 define a “computer contaminant” and a “computer virus” to include instructions or programmes designed to modify or destroy data, to usurp the normal operation of a computer, or to degrade or adversely affect the performance of a computer resource.63
Clause (iv) of the Explanation defines “damage” as destroying, altering, deleting, adding, modifying or rearranging any computer resource by any means.64 Ransomware encryption need not involve the permanent destruction of data. When it alters or modifies data and makes it inaccessible to the user, it may fall within the scope of “damage”.
Under Section 43(i), even though encryption leaves the data stored, it prevents the authorised user from accessing the data without the decryption key, thereby “diminishing the utility” of the information.
C. Denial and disruption of access
Conduct: When the attacker encrypts the data, the attack disrupts the computer and also makes the data inaccessible to the authorised user.
Application: Section 43(e) deals with disrupting, or causing the disruption of, a computer, computer system or computer network.65 The attacker interferes with and disrupts the computer system.
Section 43(f) deals with denying, or causing the denial of, access to any person authorised to access a computer, computer system or computer network.66
Where the denial of access is directed at critical information infrastructure or essential services, Section 66F may also be engaged; the Delhi Police invoked it after the attack on AIIMS.67 The offence, however, requires an intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people, and, in the case of critical information infrastructure, an adverse effect on infrastructure specified under Section 70. It will therefore reach only those ransomware attacks in which that intent and effect can be shown.68
Interpretation: “Disruption” means interference with the normal functioning of the computer system, and “denial of access” prevents the authorised user from reaching it. Section 43(f) applies where access is denied “by any means”, so it does not depend on how the denial is achieved; encryption that leaves a system running but locks the authorised user out of the data falls within its terms. Both clauses also reach a person who “causes” the disruption or denial, which covers an attacker who sets the ransomware running rather than interfering with the system directly. The Explanation to Section 43 points the same way, since a “computer contaminant” includes instructions designed to usurp the normal operation of a computer, computer system or computer network. Ransomware therefore falls within the scope of Sections 43(e) and 43(f).
D. Data theft or exfiltration
Conduct: The attacker encrypts and copies sensitive data from the victim’s computer and transfers it to an external server without permission.
Application: Section 43(b) addresses data or information that is downloaded, copied or extracted from a computer system.69
Interpretation: Copying and transferring the data falls within the ordinary meaning of Section 43(b).
Where the exfiltrated data includes personal data, the Digital Personal Data Protection Act, 2023 is also engaged. The Act defines a “personal data breach” to include any unauthorised processing of personal data, or its accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability,70 so both the theft of personal data and its encryption may qualify. A Data Fiduciary must take reasonable security safeguards to prevent a personal data breach and must intimate the Data Protection Board of India and each affected Data Principal when one occurs; the Schedule to the Act provides penalties of up to ₹250 crore and ₹200 crore respectively for breach of these two duties.71 Rule 7 of the Digital Personal Data Protection Rules, 2025 requires the Data Fiduciary to inform each affected Data Principal without delay, and to inform the Board without delay and then, within seventy-two hours, with detailed information about the breach and the measures taken; the rule comes into force eighteen months after the Rules were published on 13 November 2025.72 These duties fall on the victim organisation rather than on the attacker, but they bear directly on how a ransomware incident involving personal data must be handled.
E. Ransom demand
Conduct: The attacker demands payment in exchange for restoring access to the encrypted data. The attacker may put the victim in fear by threatening to publish stolen data, or otherwise compel the victim to pay the ransom, and may put further pressure on the victim by threatening or contacting third parties connected with the victim.
Application: Under Section 308(1), the attacker may put the victim in fear of injury and dishonestly induce the victim to deliver property or a valuable security as ransom.73
Under Section 351(1), the attacker may threaten the victim with injury to his person, reputation or property, with intent to cause alarm or to compel him to do an act that he is not legally bound to do, or to omit an act that he is legally entitled to do.74
Interpretation: A threat to disclose stolen data may put the victim in “fear of injury”, and Illustration (e) to Section 308(1), which concerns a threat sent by means of an electronic device, shows that the medium of the threat does not matter.75 However, as ransom payments are increasingly demanded in cryptocurrency, the expressions “property” and “valuable security” must be examined to determine whether a cryptocurrency payment can fall within Section 308. In Rhutikumari v. Zanmai Labs Pvt. Ltd., an application for interim protection in an arbitration concerning cryptocurrency held on the WazirX exchange, the Madras High Court held that cryptocurrency is property: although it is neither tangible property nor currency, it is capable of being enjoyed and possessed in a beneficial form and of being held in trust.76 That case did not arise under Section 308. This paper argues, however, that on the same reasoning a cryptocurrency ransom is “property” delivered by a person put in fear, and so can fall within the offence of extortion. When the attacker threatens to disclose stolen data, such disclosure may damage the victim’s reputation or property. The threat may therefore fall within Section 351 where the required intention to cause alarm or to compel the victim is established. Its application can also be examined in relation to evolving forms of extortion, such as double and triple extortion, where additional threats are made against the victim or persons connected with the victim.
F. Cross-border attacks
Conduct: The attacker may operate from outside the country, use a server located in another country and target a victim located in yet another, so that the attack involves multiple jurisdictions.
Application: Section 75 of the IT Act provides extraterritorial jurisdiction where the offence or contravention is committed from another country and the conduct involves a computer, computer system or computer network located in India.77
Under Section 1(5)(c) of the BNS, a person who commits an offence outside India targeting a computer resource located in India is punishable under the Sanhita.78
Interpretation: The expressions “involves a computer, computer system or computer network located in India” and “targeting a computer resource located in India” establish a jurisdictional connection between the foreign conduct and the computer resource situated in India. However, practical enforcement, including identifying attackers, obtaining electronic evidence and managing differences between legal systems, remains challenging.
Comparative analysis
The United States does not have a standalone statute for ransomware attacks. Instead, ransomware is addressed through an existing federal law, the Computer Fraud and Abuse Act (CFAA). Under 18 U.S.C. § 1030(a)(5), the CFAA covers knowingly causing the transmission of a program, information, code or command and, as a result, intentionally causing damage without authorisation to a protected computer, and intentionally accessing a protected computer without authorisation and, as a result, recklessly causing damage, or causing damage and loss.79 Under 18 U.S.C. § 1030(a)(7), it covers the transmission, with intent to extort, of a threat to damage a protected computer, a threat to obtain information from it or to impair the confidentiality of such information, or a demand for money in relation to damage caused to facilitate the extortion.80
The US approach to ransomware is not limited to the application of criminal law. It also takes an institutional approach through the Cybersecurity and Infrastructure Security Agency (CISA), which provides guidance on prevention, incident response, reporting, evidence preservation and recovery, and which recognises both encryption and the theft of data for ransom, including double extortion.81 The Federal Bureau of Investigation (FBI) issues advisories on new ransomware variants and attacker techniques. By April 2026, Medusa, a ransomware-as-a-service (RaaS) variant whose developers and affiliates use a double-extortion model, encrypting victims’ data and threatening to release exfiltrated data, had affected more than 500 victims. The FBI, with CISA and the Department of Health and Human Services, accordingly updated its joint advisory to help organisations detect and respond to Medusa.82 The Joint Ransomware Task Force (JRTF), co-chaired by CISA and the FBI, coordinates the government’s response and identifies new initiatives against ransomware.83 The Department of Justice (DOJ) helps to identify and investigate ransomware attackers, trace cryptocurrency paid as ransom, collect evidence and prosecute offenders.84 Victims are encouraged to report incidents to the FBI, its Internet Crime Complaint Center (IC3) or CISA. Such reporting enables federal authorities to obtain information about the incident, assist the affected organisations, support investigation and preserve evidence.85 The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires CISA to make rules under which covered entities must report covered cyber incidents within 72 hours and ransom payments within 24 hours; CISA is still working on the final rule, and reporting will not be required until that rule takes effect. Until then, organisations are encouraged to report voluntarily.86 In January 2023, as CIRCIA required, CISA established the Ransomware Vulnerability Warning Pilot (RVWP), which identifies vulnerabilities commonly associated with ransomware exploitation and warns the critical infrastructure entities that have them, so that they can be addressed before exploitation.87 The Office of Foreign Assets Control (OFAC) addresses the financial side of ransomware through sanctions, designating ransomware operators and the virtual currency exchanges that launder their proceeds; persons who transact with designated entities may themselves be exposed to sanctions. Companies are encouraged to report all ransomware incidents to law enforcement, and any payment with a potential sanctions nexus to OFAC.88
In India, the Indian Computer Emergency Response Team (CERT-In) functions as the national agency for responding to computer security incidents. In relation to ransomware, CERT-In provides incident response assistance and issues advisories and guidance on identifying and isolating affected systems, strengthening security controls, and recovering and monitoring affected systems.89 India has also established a mandatory cyber incident reporting mechanism through the CERT-In Directions issued under Section 70B(6) of the IT Act, which require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber security incidents to CERT-In within six hours of noticing them or being informed of them. Ransomware attacks are among the reportable incidents.90
The United States specifically addresses computer-related extortion, covering threats to damage protected computers, to obtain information from them or to impair the confidentiality of that information. The BNS, by contrast, deals with extortion generally and contains no provision expressly addressing computer-related extortion. The CFAA also expressly defines “damage” to include any impairment to the availability of data, a program, a system or information,91 whereas the definition of “damage” in the Explanation to Section 43 of the IT Act does not expressly mention impairment of availability. The United States enacted CIRCIA to create a broader reporting framework that specifically includes ransom payments. India has a mandatory incident reporting requirement but no specific framework for reporting ransom payments. Although CERT-In issues advisories on preventive measures, shares tailored alerts with organisations through an automated threat intelligence exchange platform and sends daily alerts on malware infections and vulnerable services,92 neither the Directions nor these advisories create a ransomware-specific warning programme comparable to the RVWP.
The comparative study shows that India possesses a legal and institutional framework to address ransomware attacks. However, the comparison with the United States indicates certain areas in which greater clarity in the Indian framework could strengthen the application of existing law to evolving forms of ransomware attack.
Findings, suggestions and conclusion
A. Findings
1. India lacks dedicated legislation on ransomware attacks. However, the existing framework, comprising the IT Act, 2000 and the BNS, 2023, provides legal coverage of the conduct involved in a ransomware attack, including unauthorised access, data exfiltration, disruption and denial of access to authorised users.
2. Although encryption does not necessarily destroy the original data, it can make the data inaccessible to the authorised user; encryption therefore falls within the scope of damage, alteration and diminishing the utility of information under Section 43.
3. The existing legal framework relies on the general penal provision for extortion in Section 308 of the BNS, 2023, so that digital threats must be interpreted through traditional legal concepts. Unlike jurisdictions such as the United States, which expressly penalise extortion involving protected computers, Indian statutes contain no express, dedicated provision addressing computer-related extortion.
4. Cryptocurrency is intangible, but it has economic value and can be possessed, transferred and sold. The Madras High Court has held it to be property capable of being held in trust, and on that reasoning this paper argues that virtual digital assets fall within the expression “property” for the purpose of the offence of extortion.
5. Although the CERT-In reporting mechanism mandates incident notification within six hours, India, unlike the United States, has no specific regulatory framework or reporting mechanism governing the payment of ransoms. CERT-In issues advisories and alerts on threats and vulnerable services, but it has no ransomware-specific vulnerability warning programme comparable to the RVWP in the United States.
6. Extraterritorial jurisdiction is established for attacks committed from outside the country. However, practical difficulties remain in identifying the attacker, dealing with the different laws of different countries and collecting evidence.
B. Suggestions
1. Instead of enacting a separate statute specifically for ransomware, India can rely on existing legal frameworks such as the IT Act, 2000 and the BNS, 2023. Ransomware is not a single offence; it involves multiple acts, including unauthorised access, data theft, alteration or encryption of data and extortion. Such acts can be addressed through the existing legal framework by interpretation.
2. Section 43 of the IT Act, 2000 can be applied to encryption, but it does not expressly mention unauthorised encryption or clarify whether the temporary inaccessibility of data amounts to damage. This could be clarified by a specific explanation stating that the unauthorised impairment of the accessibility or availability of data constitutes damage. Such an explanation would provide greater clarity in applying the existing provision to ransomware attacks.
3. The existing laws can be effective only if law enforcement agencies are provided with specialised digital forensic tools to preserve and analyse electronic evidence in ransomware attacks. Specialised mechanisms can also be strengthened to deal with practical difficulties, including identifying offenders who hide their identity through proxy networks, encrypted communications and other methods. Blockchain tracing tools can further help authorities to track cryptocurrency ransom payments.
4. CERT-In and other relevant authorities can issue clear guidelines on ransomware incidents, including the reporting of ransom demands. CERT-In can also build on its existing alerts by identifying vulnerabilities known to be exploited by ransomware and informing the organisations exposed to them before attackers exploit them. Such measures would improve ransomware reporting, early detection and prevention in India.
5. Although Indian law provides for extraterritorial application, obtaining electronic evidence and sharing information with other countries may cause delays. India can therefore strengthen international cooperation to facilitate the identification of offenders and the securing of electronic evidence of ransomware-related offences across borders.
C. Conclusion
The existing legal framework under the IT Act, 2000 and the BNS, 2023 is broadly capable of reaching the conduct involved in a ransomware attack without a standalone statute. However, the application of these provisions is not equally clear for every form of ransomware conduct. Encryption, in particular, raises questions concerning damage, alteration and the diminishing of the utility of data. Legal provisions alone cannot resolve the practical difficulties. Although Indian law provides a basis for dealing with cross-border conduct and an incident reporting mechanism, effective enforcement also depends on institutional coordination and international cooperation. The comparative analysis of the United States further shows that greater clarity and supporting mechanisms could strengthen the Indian response to evolving ransomware attacks. The study therefore concludes that the existing legal framework provides a legal basis for addressing ransomware conduct, but that greater clarity, such as an explanation to Section 43 on the impairment of the availability of data, and supporting mechanisms are required for its consistent and effective application to evolving forms of ransomware. What is needed is therefore not a standalone ransomware statute, but an existing framework that remains sufficiently clear and effective to address ransomware’s changing forms.
*****
Footnotes
1. Nikhil Naren & Kashish Gupta, Rethinking India’s Cybercrime Law: From Information Technology Act to Emerging Threats in a Global Context, Int’l Rev. L. Computs. & Tech. (2026), https://doi.org/10.1080/13600869.2026.2668321.
2. European Union Agency for Cybersecurity, ENISA Threat Landscape for Ransomware Attacks 5, 24 (Ifigeneia Lella et al. eds., July 2022), https://www.enisa.europa.eu/sites/default/files/publications/ENISA%20Threat%20Landscape%20for%20Ransomware%20Attacks.pdf.
3. Nikita Srinivas Kasabed, Ransomware Evolution and Defence Strategies, 9 Int’l J. Sci. Rsch. Eng’g & Mgmt. no. 10, at 1–2 (Oct. 2025), https://ijsrem.com/uploads/production/Ransomware-Evolution-and-Defence-Strategies.pdf.
4. Manuj Aggarwal, Ransomware Attack: An Evolving Targeted Threat, in 2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT) 1 (2023), https://doi.org/10.1109/ICCCNT56998.2023.10308249 (last visited Sept. 13, 2026).
5. Amanasubramanian & Sadhana Sai Bhaskar, Multi-Jurisdictional Approach to Combatting Ramsomware, 6 Int’l J. for Multidisciplinary Rsch. no. 6 (Nov.–Dec. 2024), https://doi.org/10.36948/ijfmr.2024.v06i06.31759.
6. Amit Yadav, Pankaj Kumar, Arpit Totuka, Deepankar Sharma & Paridhi Jain, Cyber Extortion Revealed: An Analysis of Ransomware’s Development, Strategies, Obstacles, and Prospects for the Future, 14 Eur. Econ. Letters 884 (2024), https://doi.org/10.52783/eel.v14i2.1417.
7. P. Priya Raghavendra, Legal Framework for Combatting Ransomware Attacks – Policies and Recommendations, 5 Indian J. Integrated Rsch. L. 672 (2025), https://ijirl.com/wp-content/uploads/2025/07/LEGAL-FRAMEWORK-FOR-COMBATTING-RANSOMWARE-ATTACKS-POLICIES-AND-RECOMMENDATIONS.pdf.
8. Ashima Sarin, Ransomware Attacks and India’s Cyber Legal Framework: Are Existing Laws Adequate to Combat Digital Extortion?, Lawful Legal (July 1, 2026), https://lawfullegal.in/ransomware-attacks-and-indias-cyber-legal-framework-are-existing-laws-adequate-to-combat-digital-extortion/.
9. Matthew Kosinski, Stephanie Susnjara & Michael Goodwin, What Is Ransomware?, IBM Think, https://www.ibm.com/think/topics/ransomware.
10. Ransomware Attack – What Is It and How Does It Work?, Check Point Software Technologies, https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/; Raghavendra, supra note 7, at 684–86.
11. Kasabed, supra note 3, at 3.
12. Harshada U. Salvi & Ravindra V. Kerkar, Ransomware: A Cyber Extortion, 2 Asian J. Convergence Tech. no. 3, at 2–3 (2016), https://asianssr.org/index.php/ajct/article/view/198.
13. What Is Crypto Ransomware? Definition, Types, RaaS & Tracing, Chainalysis, https://www.chainalysis.com/glossary/crypto-ransomware/.
14. What Is Ransomware? Definition & Prevention, Proofpoint, https://www.proofpoint.com/us/threat-reference/ransomware.
15. Understanding Common Ransomware Types in 2024, Commvault (Aug. 27, 2025), https://www.commvault.com/explore/types-of-ransomware.
16. Id.
17. Aggarwal, supra note 4.
18. Raghavendra, supra note 7, at 676.
19. Chainalysis, supra note 13.
20. What Is Ransomware-as-a-Service (RaaS)?, Sophos, https://www.sophos.com/en-us/cybersecurity-explained/ransomware-as-a-service (last visited Sept. 13, 2026).
21. Gourav Nagar, The Evolution of Ransomware: Tactics, Techniques, and Mitigation Strategies, 12 Int’l J. Sci. Rsch. & Mgmt. 1282, 1284 (2024), https://doi.org/10.18535/ijsrm/v12i06.ec09.
22. Ronny Richardson, Max M. North & Sarah M. North, The Evolution of Ransomware: An Analytical Exploration, 22 Int’l Mgmt. Rev. 87, 87–88 (2026), https://americanscholarspress.us/journals/IMR/pdf/IMR-1-2026/IMRv22N12026-art6.pdf.
23. Kasabed, supra note 3, at 2.
24. Nagar, supra note 21, at 1286.
25. Richardson, North & North, supra note 22, at 88.
26. Salvi & Kerkar, supra note 12, at 2; Nagar, supra note 21, at 1286.
27. Sophos, supra note 20.
28. Nagar, supra note 21, at 1286–87.
29. Nagar, supra note 21, at 1287.
30. Sule Tatar, The Dangers of Double and Triple Extortion in Ransomware Attacks, Arctic Wolf (Apr. 29, 2025), https://arcticwolf.com/resources/blog/dangers-of-double-and-triple-extortion/.
31. Raghavendra, supra note 7, at 673; see also Chainalysis, supra note 13 (payment does not guarantee a working decryption key).
32. Tabassum Barnagarwala, AIIMS Is Struggling to Restore Services After Hackers Cripple Its Computer Systems, Scroll.in (Nov. 30, 2022), https://scroll.in/latest/1038702/how-aiims-is-working-to-restore-services-after-hackers-crippled-its-computer-systems; Apurva Venkat, Ransomware Attackers Allegedly Demand Ransom from AIIMS: Police Deny Report, CSO Online (Nov. 29, 2022), https://www.csoonline.com/article/574153/ransomware-attackers-allegedly-demand-ransom-from-aiims-police-deny-report.html; see also AIIMS Delhi Ransomware Incident, CyberBreaches, https://www.cyberbreaches.org/en/incidents/aiims-delhi-2022.
33. What Was the WannaCry Ransomware Attack?, Cloudflare, https://www.cloudflare.com/learning/security/ransomware/wannacry-ransomware/ (last visited Sept. 17, 2026); ‘Wannacry’ Ransomware Attack: Govt Says It Has Activated a ‘Preparedness and Response Mechanism’, The News Minute (May 15, 2017), https://www.thenewsminute.com/amp/story/news/wannacry-ransomware-attack-govt-says-it-has-activated-preparedness-and-response-mechanism.
34. Vinod Kumar, CAG Flags Inability to Protect Sensitive Data After Ransomware Attack at Punjab Cancer Centre, Times of India (Aug. 26, 2026), https://timesofindia.indiatimes.com/city/chandigarh/cag-flags-inability-to-protect-sensitive-data-after-ransomware-attack-at-punjab-cancer-centre/articleshow/133547927.cms.
35. Daryna Antoniuk, Indian Auto Giant Bajaj Auto Hit by Ransomware Incident, The Record (June 24, 2026), https://therecord.media/indian-auto-giant-bajaj-auto-hit-by-ransomware.
36. Institute for Security and Technology, Combating Ransomware: A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force 16–17 (2021), https://securityandtechnology.org/wp-content/uploads/2021/09/IST-Ransomware-Task-Force-Report.pdf.
37. D. Vinothini, Ransomware Attacks and Cryptocurrency: Legal Challenges in Investigation, 6 Int’l J. Advanced Rsch. Sci. Commc’n & Tech. 45, 47 (2026), https://ijarsct.co.in/Paper36305.pdf.
38. Raghavendra, supra note 7, at 681.
39. Vinothini, supra note 37, at 47.
40. Raghavendra, supra note 7, at 683–84.
41. Kasabed, supra note 3, at 1–2; Tatar, supra note 30; Institute for Security and Technology, supra note 36, at 16.
42. The Information Technology Act, No. 21 of 2000, India Code (2000), § 43 [hereinafter IT Act].
43. IT Act § 66.
44. IT Act § 66D.
45. IT Act § 66F.
46. IT Act § 75.
47. The Bharatiya Nyaya Sanhita, No. 45 of 2023, India Code (2023), § 308 [hereinafter BNS] (corresponding to §§ 383–389 of the Indian Penal Code, 1860).
48. BNS § 318 (corresponding to §§ 415, 417, 418 and 420 of the Indian Penal Code, 1860).
49. BNS § 324(1)–(2) (corresponding to §§ 425–426 of the Indian Penal Code, 1860).
50. BNS § 351 (corresponding to §§ 503, 506 and 507 of the Indian Penal Code, 1860).
51. IT Act § 43(a).
52. IT Act § 2(1)(a).
53. BNS § 2(7). The Explanation to IT Act § 66 adopts the meanings of “dishonestly” and “fraudulently” in §§ 24 and 25 of the Indian Penal Code, 1860, which BNS § 2(7) and (9) now carry.
54. BNS § 2(9).
55. IT Act § 66D.
56. BNS § 318(1)–(2).
57. Gagan Harsh Sharma v. State of Maharashtra, 2018 SCC OnLine Bom 17705 (Crim. Writ Pet. No. 4361 of 2018, decided Oct. 26, 2018) (quashing the FIR insofar as it concerned offences under the Indian Penal Code, on the ground that the IT Act covered the conduct); but see Awadhesh Kumar Parasnath Pathak v. State of Maharashtra, 2024 SCC OnLine Bom 1074 (Full Bench) (holding, on a reference that questioned Gagan Harsh Sharma, that an accused may be tried for overlapping offences under both the IT Act and the Indian Penal Code).
58. The Seven Phases of a Ransomware Attack: A Step-by-Step Breakdown of the Attack Lifecycle, Flashpoint (July 10, 2023), https://flashpoint.io/blog/the-anatomy-of-a-ransomware-attack/ (last visited Sept. 26, 2026).
59. IT Act § 43(c).
60. IT Act § 43(d).
61. IT Act § 43(i).
62. BNS § 324(1), (5).
63. IT Act § 43, Explanation, cls. (i), (iii).
64. IT Act § 43, Explanation, cl. (iv).
65. IT Act § 43(e).
66. IT Act § 43(f).
67. Barnagarwala, supra note 32.
68. IT Act §§ 66F(1)(A), 70(1) & Explanation.
69. IT Act § 43(b).
70. The Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023), § 2(u) [hereinafter DPDP Act].
71. DPDP Act § 8(5)–(6), sch., items 1–2.
72. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rr. 1(4), 7 (Nov. 13, 2025) (India).
73. BNS § 308(1).
74. BNS § 351(1).
75. BNS § 308(1), illus. (e).
76. Rhutikumari v. Zanmai Labs Pvt. Ltd., 2025 SCC OnLine Mad 9290, ¶ 47 (O.A. No. 194 of 2025, decided Oct. 25, 2025).
77. IT Act § 75.
78. BNS § 1(5)(c) (corresponding to § 4 of the Indian Penal Code, 1860).
79. Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5).
80. 18 U.S.C. § 1030(a)(7).
81. Cybersecurity & Infrastructure Security Agency, #StopRansomware Guide (Sept. 2023), https://www.cisa.gov/stopransomware/ransomware-guide (last visited Sept. 27, 2026).
82. Cybersecurity & Infrastructure Security Agency, Federal Bureau of Investigation & U.S. Department of Health & Human Services, #StopRansomware: Medusa Ransomware, Joint Cybersecurity Advisory AA25-071A, at 2, 5 (Mar. 12, 2025, updated Aug. 18, 2026), https://www.ic3.gov/CSA/2026/260818.pdf.
83. Joint Ransomware Task Force, Cybersecurity & Infrastructure Security Agency, https://www.cisa.gov/joint-ransomware-task-force.
84. Press Release, U.S. Dep’t of Just., Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside (June 7, 2021), https://www.justice.gov/archives/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside.
85. Cybersecurity & Infrastructure Security Agency, supra note 81; Ransomware, Federal Bureau of Investigation, https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/ransomware (last visited Sept. 27, 2026).
86. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), Cybersecurity & Infrastructure Security Agency, https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia (last visited Sept. 28, 2026).
87. Sandra Radesky & Gabriel Davis, Ransomware Vulnerability Warning Pilot Updates: Now a One-Stop Resource for Known Exploited Vulnerabilities and Misconfigurations Linked to Ransomware, Cybersecurity & Infrastructure Security Agency (Oct. 12, 2023), https://www.cisa.gov/news-events/news/ransomware-vulnerability-warning-pilot-updates-now-one-stop-resource-known-exploited-vulnerabilities.
88. Press Release, U.S. Dep’t of the Treasury, Treasury Continues to Counter Ransomware as Part of Whole-of-Government Effort; Sanctions Ransomware Operators and Virtual Currency Exchange (Nov. 8, 2021), https://home.treasury.gov/news/press-releases/jy0471.
89. Indian Computer Emergency Response Team, Responding to Ransomware Attacks, CERT-In Advisory CIAD-2022-0023 (Sept. 27, 2022), https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2022-0023.
90. Indian Computer Emergency Response Team, Directions Under Sub-Section (6) of Section 70B of the Information Technology Act, 2000 Relating to Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents for Safe & Trusted Internet, No. 20(3)/2022-CERT-In, ¶ (ii) & annex. I, item (v) (Apr. 28, 2022), https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf.
91. 18 U.S.C. § 1030(e)(8).
92. Press Release, Ministry of Elecs. & Info. Tech., Government’s Initiatives to Strengthen Security of Cyber Ecosystem, Including Against Ransomware and Cross-Border Cybercrime (Dec. 17, 2025), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2205047.