What Is Section 66 of the IT Act?
Key takeaways
- Section 66 requires knowledge or intention. Mere accidental damage, a configuration mistake or an outage caused by your own staff is not hacking, and pleading mens rea is often the whole defence.
- The punishment is imprisonment up to three years, or a fine up to Rs 5 lakh, or both, and the same section is charged for a ransomware intrusion and a manual database edit.
- Introducing a virus, damaging or disrupting a system, denying service or denying access, and tampering with computer contents are all separate limbs of section 66.
- Civil compensation under section 43 and a criminal complaint under section 66 can be pursued at the same time, and the civil route does not need proof beyond reasonable doubt.
- The 2008 amendment created separate, more serious liability for an employee or an insider who breaches the security of a computer in the course of his duties under section 66.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What conduct does section 66 actually criminalise?
Section 66 has six limbs, and they are wider than the word hacking suggests. It covers compromising the security of a computer, system or network; damaging or disrupting it; introducing or injecting a virus; damaging, disrupting, denying service or denying access to it; and causing damage to a computer. An intrusion that leaves no trace but copies data is still covered by the first limb, and a ransomware payload is covered twice over, as a compromise and as a virus. Section 66 also reaches tampering with computer contents, which is why a manual edit by an insider through a privileged account is a criminal question and not only a data integrity one.
What mens rea does section 66 require?
Section 66 is a specific intent offence: the act must be done knowingly or intentionally, or the damage must be caused knowingly or intentionally. That word is the defence's best lever, because the actus reus is broad and the state still has to prove the mental element. An employee who fat-fingers a delete key has not committed hacking. A systems failure during a patch window is not a virus injection. A contractor who knowingly copied customer records for a competitor has. In practice, forensic evidence, log timelines and access records become the case, which is why log retention matters beyond compliance.
What punishment does section 66 carry?
The general limb of section 66 carries imprisonment of up to three years, or a fine of up to Rs 5 lakh, or both. The proviso escalates the punishment where the hacking is done without authorisation, where the intent is to gain access to a computer resource in order to cause damage or to steal, or where the intent is to steal commercially valuable information. On a cyber appellate tribunal reference, the additional imprisonment is up to five years and the additional fine up to Rs 5 lakh. Sentences in practice are driven by the value taken, the number of victims, and whether the case crosses into cheating under the Bharatiya Nyaya Sanhita.
How does a section 66 case differ from a civil claim?
A section 66 case is a criminal prosecution run by the state, with the burden of proof on the prosecution beyond reasonable doubt, and it is slow: investigation, summons, and typically a year or more before trial in a metropolitan cyber crime court. A civil claim under section 43 for unauthorised access is faster, the burden is closer to the balance of probabilities, and the evidence you need is largely technical. Businesses that suffered a quantifiable loss routinely run both: the civil claim recovers money, and the criminal complaint creates the police record and the pressure that produces a confession.
| Limb of section 66 | What it covers | Typical Indian example |
|---|---|---|
| Compromising security | Unauthorised access to a system, network or account | Credential stuffing against a customer portal |
| Injecting a virus | Introducing malicious code into a computer | Ransomware payload dropped via a phishing attachment |
| Damage or disruption | Deleting, encrypting or corrupting data and systems | A wiped file server and an encrypted file share |
| Denying service or access | Making a system or its data unavailable | A targeted denial-of-service run during a festive sale |
| Tampering with contents | Altering data or records in a computer | An insider editing transaction limits in the core banking feed |
| Employee or insider breach | Breach of security by a person in the course of duties | A support engineer exporting a customer database to a personal drive |
What are the frequently asked questions?
Get a straight answer on this
Send us the incident timeline and we will return a written view on which limbs of section 66 apply and what evidence a civil claim would need.
Send us the details See pricing