How do I recover from a ransomware attack in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What should happen in the first six hours?

In order. Hour one: isolate the affected segment at the network layer, and revoke all active sessions rather than just disabling accounts, because a disabled account with a live token is still an open door. Hour two: preserve. Keep the affected machines running if you can, take disk images, export logs, and record the timestamps, because CERT-In requires a report within six hours of noticing the incident and 180-day logs are what prove when you noticed. Hour three: file the CERT-In report to incident@cert-in.org.in or 1800-11-4949 with occurrence and detection timestamps. Hours four to six: begin rotation of credentials, notify legal and the insurer, and contact a CERT-In empanelled incident responder, if not already under retainer.

How do you restore safely, and why do backups fail too?

Restore only from backups that are offline, immutable and tested, and treat every restore as suspect until it is verified. Backups fail for four recurring reasons. They were reachable from the same domain, so the attacker deleted the shadow copies before encrypting. They were online, so the malware encrypted the backup repository as well. They were never tested, so the restore has failed silently for months. And they were too slow to restore, so the business pressure was to rebuild from scratch. A quarterly restore test, timed and documented, is what converts a backup from an assumption into an asset, and it is far cheaper than discovering the failure during an incident.

Which credentials do people forget to rotate?

The ones that are not human. Domain admin and service accounts. VPN and remote-access credentials, especially the ones used by IT support tools. Cloud keys and tokens, including long-lived access keys. CI/CD pipeline tokens and registry secrets, because a build pipeline is a privileged path into production. Backup console credentials, which is how the attacker reached the backups in the first place. Email and messaging integration tokens, which carry the ability to send as you. And API keys for payment gateways. In a compromise of this size, assume every one of these is burned, and rotate from a known-clean system rather than from a machine on the compromised network.

Why is exfiltration testing the step that closes the loop?

Because double extortion was the default operating procedure in H1 2026, so the attacker usually has your data before they encrypt it. Restoring from backup without testing whether data left is not recovery, it is a partial recovery with an open breach still in progress, and the regulator, the customer and the insurer will all ask the same question: what left, and when? The test is forensic: network and firewall flow analysis, proxy and DNS logs, DLP records, endpoint telemetry and any archive activity on file servers, corroborated with the attacker's own timeline from the ransom note or leak site. Then notify the affected individuals, and plan the credit monitoring and customer communication that follows.

What are the frequently asked questions?