Is Ransomware the Biggest Threat Facing Indian Businesses?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What do the 2026 ransomware numbers tell us?

Three things. First, volume: 77 attacks in six months, with India second most hit in APAC (Cyble CRIL, reported by Fortune India, 23 July 2026). Second, distribution: Indian SMB detections rose from 3.18% to 4.07% in a year, so the attacks are not concentrated on large enterprises any more, they are concentrated on the small supplier who has a privileged connection to one. Third, monetisation: extortion is not only about encrypting, it is about the data. When a hospital's patient records are in the mix, the attacker has leverage that a pure encryption event never provided, and the choice between paying and facing a public breach notification stopped being theoretical.

Why do small Indian firms get hit when large ones spend more?

Because the control set that actually stops ransomware is cheap and unglamorous, and small firms skip it. MFA on remote access, endpoint detection and response on every laptop, offline immutable backups that a domain administrator cannot delete, network segmentation that stops a compromised laptop reaching the finance systems, and patch discipline. Add to that a monitoring relationship, because a small firm will not have a security operations centre and depends entirely on being told. The number to hold on to is that a Kochi hospital was listed by the same ransomware group in March 2026, the month an Ernakulam hospital lost over 800GB of patient data, which is a concentration of pressure on exactly the organisations that can least afford it.

What should a business do in the 24 hours after a ransomware email?

Nine steps, in this order, and speed matters more than perfection. Confirm it is ransomware rather than a failed patch, by checking the ransom note and the file extensions. Disconnect the affected host from the network, but do not wipe it. Disable the compromised identity and revoke its sessions, because the attacker usually has a valid session. Check whether the backups are reachable and, critically, whether they are writable by the attacker's credentials. Engage a forensic examiner before restoring, because restoring over a live foothold simply re-encrypts. Notify CERT-In for a listed incident within 6 hours to incident@cert-in.org.in, and report financial fraud on cybercrime.gov.in or 1930 if money moved. Do not pay as a first move, and do not delete logs.

How do you decide whether to pay the ransom?

It is a business decision taken with counsel, not a technical one, and it is never a first-hour decision. The questions are whether a working decryptor is guaranteed, because payment regularly does not deliver one, whether paying is lawful where the group is sanctioned, whether the data is already exfiltrated so payment buys nothing, and what the reputational and regulatory cost is of refusing, particularly for a health or financial organisation. The most useful preparation is not a payment policy, it is a recovery capability: an offline immutable backup set, a documented restore procedure, and a rehearsed rebuild, because a business that can restore in 24 hours does not need to decide. AAVETech runs fixed-price ransomware readiness reviews and recovery planning at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST.

What are the common questions about R?