Ransomware Attack: What an Office Should Do in the First 6 Hours

In a ransomware attack, an office should note the time, isolate affected systems from the network, preserve logs and evidence, report to CERT-In within 6 hours of noticing the incident, inform the head of office and file a police complaint with the cyber cell, and only then restore from clean, tested backups. Do not wipe systems first and report later. Failure to report under the CERT-In Directions of 28 April 2022 is punishable under s.70B(7) of the IT Act with up to 1 year, or fine up to ₹1 lakh, or both. From 13 May 2027, a breach of personal data must also be intimated to the Data Protection Board and affected persons.

The first 6 hours, step by step

At 9.10 on a Monday, the office superintendent of a government college in Meerut finds the administrative server locked, with a note in every folder demanding cryptocurrency. The order to follow:

1. Note the time (9.10 am). The 6-hour CERT-In clock runs from when the incident is noticed, not from when the damage is fully understood. Start a written incident log: who noticed what, when.
2. Isolate (first 30 minutes). Disconnect affected machines from the network. Do not switch everything off without IT advice, as memory may hold evidence. Disconnect attached backup drives so they are not encrypted too.
3. Call the nodal officer and head of office (first hour). One person runs the incident.
4. Preserve logs and evidence (first 2 hours). Secure firewall, server, VPN, email and antivirus logs. Photograph the ransom note. Do not reimage or format systems before evidence is captured; logs should already be kept for 180 days.
5. Report to CERT-In (before 3.10 pm). Through the designated point of contact, using the reporting channel and format on cert-in.org.in. Send what you know; further details can follow.
6. Police complaint (same day). Approach the state cyber cell or police cyber unit (in Delhi, the specialised unit is IFSO), or file on cybercrime.gov.in. An FIR can be lodged at any police station under s.173 of the BNSS, including as a zero FIR or e-FIR. Government offices should also inform the parent department as its instructions require.
7. Assess personal data. Was student, patient or staff data taken? From 13 May 2027, the DPDP Rules require intimation to the Data Protection Board and each affected person.
8. Restore last, from clean, tested backups, once the entry point is understood.

The short form for every desk: isolate, preserve, report, then restore.

Lessons from the AIIMS attack, November 2022

On 23 November 2022, five servers running the e-Hospital system of AIIMS, New Delhi were compromised and about 1.3 terabytes of data was encrypted. For about two weeks, patient registration, appointments, admission and discharge ran manually. On 25 November 2022, the Delhi Police IFSO unit registered a case of extortion and cyber terrorism. In a written reply in Parliament on 16 December 2022, the Minister of State for Electronics and IT said the attack resulted from improper network segmentation, and that the data was retrieved from a backup server that was not affected.

Three lessons follow:

• Segmentation contains damage. On one flat network, one breach reaches every system.
• A backup the attack cannot reach saves the institution. Keep at least one copy off the main network and test restores.
• Serious attacks are serious crimes. Section 66F of the IT Act (cyber terrorism) covers, among other things, unauthorised access with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, causing disruption of supplies or services essential to the life of the community. It carries imprisonment which may extend to life.

Should the office pay the ransom?

No, and the reasons are practical and legal.

• No guarantee of a working key or deletion of stolen data.
• Repeat targeting of those known to pay.
• Government advice. Indian authorities have publicly advised ransomware victims not to pay, including during the WannaCry outbreak in May 2017.
• Legal exposure. Indian law has no general provision that, in terms, makes paying a ransom an offence. But the money goes to unknown criminals, often abroad. Depending on who receives it, payment can raise questions under money laundering and terror financing laws, and for a public body, spending public money on a criminal demand raises serious audit issues.
• Reporting duties remain. Paying does not remove the CERT-In, police or DPDP duties.

Any contact with the attackers should involve the head of office, lawyers and police.

Officer liability: why the sequence matters personally

Under s.85 of the IT Act, where a company (any body corporate, firm or association of individuals) commits a contravention of the Act or of directions under it, every person in charge of its business is deemed guilty unless they prove lack of knowledge or all due diligence. Whether a government department falls within s.85 depends on the facts, but the CERT-In Directions apply to government organisations expressly. An IT head who “fixed it quietly” is in a weak position; a dated incident log showing a report within 6 hours is strong evidence of diligence.

Frequently asked questions

Do government offices have to report ransomware to CERT-In?

Yes. The Directions expressly cover them.

Does the 6-hour clock start when we understand the damage?

No. It starts when the incident is noticed. Report what you know; update later.

Is paying a ransom illegal in India?

There is no general express prohibition, but payment is strongly discouraged and can raise money laundering, terror financing and audit problems. Take legal advice.

What changes from 13 May 2027?

Where personal data is affected, intimation to the Board and affected persons without delay, and a detailed Board report within 72 hours.

Quick quiz

For officers who must lead the response: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Information Technology Act, 2000: ss.43, 66, 66F, 70B(6), 70B(7), 85
• CERT-In Directions under s.70B(6), dated 28 April 2022
• Bharatiya Nyaya Sanhita, 2023: s.308; Bharatiya Nagarik Suraksha Sanhita, 2023: s.173
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: Rule 7
• Written reply of the Minister of State for Electronics and IT in Parliament, 16 December 2022, on the AIIMS cyber attack

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.