How do I respond to a suspected data breach in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What should I do in the first hour?

Four actions, in this order, and none of them involves deciding what happened. First, isolate: disconnect the affected hosts from the network, but do not power them off, because RAM and process state disappear on shutdown. Second, preserve: capture the logs, the authentication records and the running process list, and note the exact time you first noticed. Third, report: file the CERT-In notification within six hours to incident@cert-in.org.in or 1800-11-4949, with what you know. Fourth, secure the accounts: force password resets, revoke active sessions and OAuth grants, and re-issue API and cloud keys. A responder at AAVETech is engaged within 4 hours for retainer clients and within 12 hours otherwise, and by then the first hour is already gone unless someone started.

What exactly do I put in the six-hour CERT-In report?

Enough to be actionable, not enough to be complete. The initial filing should identify the affected system or systems, the closest matching category from CERT-In's Annexure I, the date and time of the occurrence if known, the date and time of detection, a brief description of the incident, and the point of contact. It should be sent from a named person at the organisation, not a generic mailbox, and it should be acknowledged internally that later updates are expected. The key point is that a report filed at hour four with partial facts is compliant, and a report filed at hour thirty because you waited to be certain is not.

How do I know whether the data actually left the building?

Assume it did, until you have evidence otherwise, because double extortion was the default operating procedure in the first half of 2026. The indicators are your own: outbound traffic to unfamiliar addresses, large transfers to cloud storage endpoints, an unusual volume of database reads, the appearance of your data in a leak site, and the timing of the intrusion relative to the encryption or the theft request. Where there is any doubt, notify on the conservative reading. The other half of the question is regulatory: the DPDP Rules, with Rule 7 notification obligations commencing from May 2027, add a data-breach notification duty to affected individuals and the Data Protection Board, and that sits alongside the CERT-In clock rather than replacing it.

When do I call the police, and what about the cyber helpline?

Call 1930, the National Cyber Crime Reporting Portal helpline, when personal data, money or accounts are involved and you need to establish an official complaint, because a FIR or a complaint registered on cybercrime.gov.in creates the record that later supports a bank reversal, a compensation claim and an insurance claim. For individuals, the sequence is: call your bank's fraud helpline first and ask for the beneficiary to be frozen and the transaction reversed, then report on cybercrime.gov.in or 1930. Under RBI's June 2026 instructions, effective 1 January 2027, a genuine individual victim with a gross loss up to Rs 50,000 may receive compensation of 85% of net loss or Rs 25,000, whichever is less, provided the fraud is reported to the bank and the NCRP or 1930 within five calendar days.

What are the frequently asked questions?