How do I know if my company has been targeted by ransomware?
Key takeaways
- India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and India is the second most ransomware-hit country in APAC.
- Shadow copy deletion and antivirus tampering are the two actions that convert a compromise into a ransomware event, so alert on both.
- CERT-In requires listed incidents, including ransomware, to be reported within 6 hours of noticing them, to incident@cert-in.org.in or 1800-11-4949.
- Ransomware in 2026 is double extortion by default, so the absence of a ransom note does not mean the absence of exfiltration.
- Indian SMB ransomware detections rose from 3.18% to 4.07% in one year, which means the entry point is now a supplier as often as your own perimeter.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What are the eight indicators of a ransomware attack?
Eight, and they cluster in time. Mass file renaming or extension changes across a share. Disk and CPU behaviour that is unlike the workload at that hour. A shadow copy or backup deletion command, which is the operational signature of ransomware. Backup jobs that stop running, or backups that are suddenly zero-length. Endpoint protection and logging being disabled, often by a domain administrator account. A ransom note file appearing in a directory. Unusual outbound traffic or a large archive being created on a file server. And gaps in domain controller or firewall logs. Any two of these in the same thirty minutes should be treated as an active incident, not a hypothesis to investigate slowly.
How do I confirm it without tipping off the attacker?
Confirm on a copy, not on the live estate. Take a read-only snapshot or disk image of one affected endpoint and one affected file server, and examine the image offline. On another affected host, look for the ransom note file and record its full path, name, timestamp and contents. Check the Windows event log for the shadow copy deletion event and for security-log clear events, and note the account that performed them, because that account name drives the credential-rotation list. Do not power off the affected machines indiscriminately, and do not run a full antivirus sweep across the estate, because both actions can destroy volatile evidence the attacker left behind.
What are my reporting obligations in India?
CERT-In's six-hour clock is the binding one. Listed incidents, which include ransomware and data breaches, must be reported to incident@cert-in.org.in or on 1800-11-4949 within six hours of noticing the incident or being brought to notice of it. CERT-In directions also require 180 days of logs, which is what proves when you knew, so log retention is not a formality but a defensibility requirement. You report what you know, not what you wish you knew: an initial filing identifying the affected system, the closest Annexure I category, and the occurrence and detection timestamps is compliant. Separately, the Digital Personal Data Protection Act 2023 and its rules, with Rule 7 notification obligations commencing from May 2027, will add a data-breach notification duty to affected individuals.
What does the scale of Indian ransomware look like right now?
It is industrial, and it targets suppliers. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and India is the second most ransomware-hit country in APAC. Indian SMB ransomware detections rose from 3.18% to 4.07% in one year, and the pattern is that a supplier's remote access, an exposed remote desktop or a malicious update is the entry route, with the real target discovered further down the chain. Kerala is not exempt: an Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
| Indicator | Where to look | What it means |
|---|---|---|
| Shadow copy deletion command | Event log, file server | Attack has moved from access to extortion |
| Endpoint protection disabled | EDR console, domain controller events | Attacker holds administrative rights |
| Mass file renaming | File server audit log | Encryption is under way |
| Backup job failure or zero-length backups | Backup console | Recovery capability is being removed |
| Ransom note file | Filesystem, in a directory | Extortion phase reached |
| Large outbound transfer or archive creation | Firewall logs, proxy logs | Exfiltration is under way |
| Security log clearing on domain controller | Windows event log | Attacker is covering tracks |
| Backup or antivirus vendor contacted by attacker | Vendor portal, support inbox | Double extortion is likely |
What are the frequently asked questions?
Get a straight answer on this
Call +91 98473 40580 now, and we will run the 6-hour CERT-In reporting checklist with you while we preserve the evidence.
Send us the details See pricing