How much does ransomware recovery cost for a small business in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does recovery actually cost, line by line?

Five lines, and they vary enormously with backup quality. Emergency response and containment, which is scoping the affected systems and isolating them, typically Rs 50,000 to Rs 3,00,000. Forensics, to determine what was accessed and what was taken, Rs 1,00,000 to Rs 4,00,000. Rebuild and restore, which is where the backups decide everything, from Rs 50,000 for a clean file restore to Rs 10,00,000 or more for a full rebuild. Hardening and monitoring, so it does not happen again, Rs 1,00,000 to Rs 5,00,000. And business recovery, covering reconciliation of accounts, customer communication and lost trading time, which never appears in a technical invoice and is often the largest real cost. If a customer, bank or insurer later disputes what happened, the forensic report also becomes the evidence document, which is worth paying for separately.

Why do costs vary so much between two similar businesses?

Almost entirely down to three factors: backups, documentation and the blast radius. A business with a nightly backup, immutable copies and a written rebuild order recovers in days; the same business with a laptop and an external hard drive recovers in weeks or never. A business that knows its user accounts, its file locations, its renewal dates and its customer list rebuilds from paper and memory; one that does not has to reverse-engineer its own operations during a crisis. And a business that segmented its network limits the blast radius to one department, while a flat network encrypts everything at once. The business that prepared operationally is not less likely to be attacked, it is simply far cheaper to recover.

Should we pay the ransom as part of the recovery budget?

Treat it as a separate decision, not a recovery line item, because payment does not guarantee a working decryptor, does not remove the attacker, and creates a compliance and reporting problem of its own. Indian law enforcement and CERT-In both advise against paying where possible, and in India payment can complicate how the incident is handled. Before you decide, get a professional read on the specific malware family, the attacker, whether backups were exfiltrated, and whether a decryptor exists. Whatever you decide, the money spent on the response is largely the same, and a business that rebuilds from clean backups and hardens the estate is usually stronger afterwards than one that paid.

What about the cost of not recovering properly?

The cost of an incomplete recovery is usually larger than the cost of a slow, clean one. Restoring partially, without knowing what was taken, leaves you running on an unpatched estate with a live access route, which often produces a second incident within months. Small Indian businesses that skip forensics also lose the ability to answer their bank, their insurer and their customers about what data was involved, which turns one incident into a contractual dispute. Given the DPDP Act 2023 and the 180-day log retention rule, having no log history is a permanent evidentiary gap. Build the recovery plan so it produces documentation as it goes, not just a working server.

What are the frequently asked questions?