Ransomware in India 2026: 77 attacks in six months, SMB detections up to 4.07%, the Gentlemen group, and why two Kerala hospitals were hit in March 2026.
Ransomware is the most consistently damaging cyber threat facing Indian businesses, and 2026 data supports that. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), making India the second most ransomware-hit country in APAC. Indian SMB ransomware detections rose from 3.18% to 4.07% in a single year, and the same group listed a Kochi hospital in March 2026, the month an Ernakulam hospital lost over 800GB of patient data. The shift toward suppliers as the route into larger firms is what matters now.
Three things. First, volume: 77 attacks in six months, with India second most hit in APAC (Cyble CRIL, reported by Fortune India, 23 July 2026). Second, distribution: Indian SMB detections rose from 3.18% to 4.07% in a year, so the attacks are not concentrated on large enterprises any more, they are concentrated on the small supplier who has a privileged connection to one. Third, monetisation: extortion is not only about encrypting, it is about the data. When a hospital's patient records are in the mix, the attacker has leverage that a pure encryption event never provided, and the choice between paying and facing a public breach notification stopped being theoretical.
Because the control set that actually stops ransomware is cheap and unglamorous, and small firms skip it. MFA on remote access, endpoint detection and response on every laptop, offline immutable backups that a domain administrator cannot delete, network segmentation that stops a compromised laptop reaching the finance systems, and patch discipline. Add to that a monitoring relationship, because a small firm will not have a security operations centre and depends entirely on being told. The number to hold on to is that a Kochi hospital was listed by the same ransomware group in March 2026, the month an Ernakulam hospital lost over 800GB of patient data, which is a concentration of pressure on exactly the organisations that can least afford it.
Nine steps, in this order, and speed matters more than perfection. Confirm it is ransomware rather than a failed patch, by checking the ransom note and the file extensions. Disconnect the affected host from the network, but do not wipe it. Disable the compromised identity and revoke its sessions, because the attacker usually has a valid session. Check whether the backups are reachable and, critically, whether they are writable by the attacker's credentials. Engage a forensic examiner before restoring, because restoring over a live foothold simply re-encrypts. Notify CERT-In for a listed incident within 6 hours to incident@cert-in.org.in, and report financial fraud on cybercrime.gov.in or 1930 if money moved. Do not pay as a first move, and do not delete logs.
It is a business decision taken with counsel, not a technical one, and it is never a first-hour decision. The questions are whether a working decryptor is guaranteed, because payment regularly does not deliver one, whether paying is lawful where the group is sanctioned, whether the data is already exfiltrated so payment buys nothing, and what the reputational and regulatory cost is of refusing, particularly for a health or financial organisation. The most useful preparation is not a payment policy, it is a recovery capability: an offline immutable backup set, a documented restore procedure, and a rehearsed rebuild, because a business that can restore in 24 hours does not need to decide. AAVETech runs fixed-price ransomware readiness reviews and recovery planning at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST.
| Indicator | Figure | Source |
|---|---|---|
| Ransomware attacks, Jan-Jun 2026 | 77 | Cyble CRIL, via Fortune India, 23 July 2026 |
| India's APAC rank | Second most hit | Cyble CRIL, via Fortune India, 23 July 2026 |
| Indian SMB detection rate | 3.18% to 4.07% in one year | Economic Times CISO, 21 July 2026 |
| Ernakulam hospital data loss, Mar 2026 | Over 800GB | The New Indian Express, 10 June 2026 |
| CERT-In reporting deadline | 6 hours from detection | CERT-In directions |
Ransomware is the most consistently damaging cyber threat facing Indian businesses, and 2026 data supports that. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), making India the second most ransomware-hit country in APAC. Indian SMB ransomware detections rose from 3.18% to 4.07% in a single year, and the same group listed a Kochi hospital in March 2026, the month an Ernakulam hospital lost over 800GB of patient data. The shift toward suppliers as the route into larger firms is what matters now.
Rarely, and never in the first hours. Payment does not reliably deliver a working decryptor, may be unlawful where the group is sanctioned, and does nothing if the data has already been exfiltrated, which is the normal case in 2026. Take the decision with counsel and a recovery plan in hand, and prefer to be able to restore in under 24 hours so the question does not arise.
Healthcare holds high-value, highly sensitive data and often runs on older infrastructure with weak segmentation, which makes it valuable for both encryption and extortion. An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
CERT-In requires listed incidents to be reported within 6 hours of detection to incident@cert-in.org.in, with the 1800-11-4949 helpline available. Logs must be retained for 180 days. If money is involved, report on cybercrime.gov.in or the 1930 helpline as well.
MFA on remote and privileged access, endpoint detection and response on every device, offline immutable backups the attacker cannot delete, network segmentation that stops lateral movement, patch discipline on internet-facing systems, and a tested incident response plan. Indian SMB detections rose from 3.18% to 4.07% in a year, which is the cost of skipping exactly these.
Yes. AAVETech runs fixed-price ransomware readiness reviews, recovery planning and tabletop exercises at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days, with retainer clients engaged within 4 hours and others within 12 during an active incident.
Read the full guide on AAVETech: Is Ransomware the Biggest Threat Facing Indian Businesses?.
Call +91 98473 40540 and ask for the ransomware readiness review; retainer clients are engaged within 4 hours and others within 12.
Talk to an analyst about this.