Incident response · India · small and mid businesses

Ransomware, a breach or invoice fraud? Who to call, and the first hour.

Reviewed by the Codesnag cyber team and the VirtualVakil legal team · Last reviewed:

Short answer

Call an incident response team and a lawyer at the same time; if you have neither, message the Codesnag cyber team on WhatsApp at +91 83682 43183 or report at codesnag.ai/report-incident, and we aim to call you back within one hour. In the first hour, isolate affected systems without switching them off, revoke sessions and rotate credentials, copy logs before they roll over, and write down when you noticed the incident. Under the CERT-In Directions of 28 April 2022, a body corporate must report the incident to CERT-In within 6 hours of noticing it; where personal data is involved, the DPDP Rules, 2025 add notices to the Data Protection Board and to affected people from 13 May 2027.

Report an incident WhatsApp +91 83682 43183

Our target is a call back within one hour of your report. The first call is free; we quote once we know the scope.

Who to call

Who to call when a cyber attack hits your business

  1. 1.An incident response team, now

    Your own security provider if you have one. If not, the Codesnag cyber team on WhatsApp or through /report-incident. Containment decisions in the first hour decide what can be recovered and proven later.

  2. 2.A lawyer, in the same hour

    Reporting clocks, notices to customers and regulators, contracts with vendors and any contact with the attacker carry legal consequences. In our team the advocates of VirtualVakil sit on the same incident.

  3. 3.CERT-In, within 6 hours

    incident@cert-in.org.in or 1800-11-4949, in the format published on cert-in.org.in. We draft the report with you.

  4. 4.Your bank, if money was sent

    For invoice or payment fraud, ask the bank at once to recall or hold the transfer, and report on 1930 or cybercrime.gov.in. Speed decides whether money can still be held.

  5. 5.Your cyber insurer, if you have a policy

    Most policies require prompt notice and may require their approved responders. Check before you engage anyone else.

The first hour

First-hour containment, before anything is restored

Isolate, do not switch off

Take affected machines off the network but leave them running. Memory holds the live session, the running process and the connection you will want to trace.

Do not wipe, restore or rebuild yet

Rebuilding destroys the evidence of what was taken and when, which the regulator, your insurer and any prosecution will ask for.

Revoke sessions and rotate credentials

Invalidate active sessions, rotate passwords, API keys and service tokens, and force re-authentication with MFA for administrators. Assume anything reachable from a compromised machine is compromised.

Copy logs before they roll over

Firewall, VPN, email, identity, server and cloud audit logs often keep only days of history. Export them now.

Start the timeline

Write down when the incident was noticed, by whom, and every action taken since. The CERT-In clock runs from when you noticed it.

Do not contact or pay the attacker without advice

Ransom notes and extortion emails are evidence. Any reply or payment has legal and practical consequences; decide it with your lawyer, not alone.

The reporting clocks

CERT-In: 6 hours from noticing the incident

“Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents.”

Direction (ii), CERT-In Directions No. 20(3)/2022-CERT-In dated 28 April 2022, issued under IT Act S. 70B(6).

  • Report to incident@cert-in.org.in, phone 1800-11-4949 or fax 1800-11-6969, using the formats on cert-in.org.in.
  • Annexure I lists 20 incident types, including unauthorised access to IT systems or data, ransomware and other malicious code, phishing and identity theft, data breach, data leak, and unauthorised access to social media accounts.
  • The same Directions require a designated Point of Contact for CERT-In, logs of all ICT systems kept securely for a rolling 180 days within India, and system clocks synchronised to the NTP servers of NIC or NPL (or servers traceable to them).
  • Failure to furnish information or to comply may invite action under IT Act S. 70B(7), according to the Directions.

DPDP: notices to the Board and to affected people

DPDP Act S. 8(6) requires a Data Fiduciary to inform the Data Protection Board and each affected Data Principal of a personal data breach. Rule 7 of the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) sets out how:

  • Each affected person: without delay, in plain language, through their account or registered contact, with a description of the breach, the likely consequences for them, the measures being taken, the steps they can take, and a contact who can answer their questions.
  • The Board: without delay, a description of the breach, including its nature, extent, timing, location and likely impact; then, within 72 hours of becoming aware (or a longer period the Board allows on a written request), detailed information, the facts and reasons, mitigation, any findings about who caused it, remedial measures and a report on the notices sent to affected people.
  • When: Rule 7 commences eighteen months after the Rules were published, which is 13 May 2027. Until then, the CERT-In 6-hour rule already covers data breaches and data leaks. Sector regulators, such as the RBI, SEBI or IRDAI, may set their own reporting rules for the entities they regulate.

More detail: data breach under DPDP: who to tell, what and when.

By incident type

Ransomware, data breach, BEC and account takeover

Ransomware

  • Find patient zero and the encryption scope before restoring anything
  • Check whether backups are intact and offline
  • Look for data theft before the encryption: double extortion is common
  • CERT-In report within 6 hours; Annexure I lists ransomware expressly

Data breach or data leak

  • Establish what data, whose, how many people, and how it left
  • Close the route: exposed bucket, leaked key, compromised account
  • CERT-In report within 6 hours: data breach and data leak are both listed
  • Prepare the DPDP notices to affected people and the Board (from 13 May 2027)

Business email compromise and invoice fraud

  • Call the bank to recall or hold the transfer; report on 1930
  • Find the mailbox rule, forwarding or OAuth app the attacker set
  • Warn customers and vendors through a verified channel
  • Police complaint and bank letters drafted by our advocates

Account takeover

  • Company email, cloud console or social media handle
  • Recover through the provider's official route; revoke tokens and app passwords
  • Check what was sent, changed or downloaded from the account
  • Report impersonation to the platform's Grievance Officer

One team

Forensics and the legal response, on the same incident

The Codesnag cyber team contains the incident and preserves the evidence; the advocates of VirtualVakil handle the reports, notices and the legal route, at the same time.

Forensics and evidence · Codesnag cyber team

  • Memory and disk images of affected systems, with hash values recorded
  • Log collection from email, identity, firewall, endpoint and cloud
  • A chain-of-custody record, so evidence can be produced with a BSA S. 63 certificate
  • Root cause, attacker activity and the data affected, in a written report

Legal response · VirtualVakil advocates

  • CERT-In incident report within 6 hours, and the follow-up information CERT-In asks for
  • DPDP breach notices to affected people and the Data Protection Board, once Rule 7 is in force
  • Police complaint and FIR request under BNSS S. 173; bank letters for payment fraud
  • Notices to customers, vendors and partners, and review of contract notice clauses
  • Advice before any contact with the attacker, and on insurer notification

What we cannot promise: decryption, recovery of data or money, or any decision of CERT-In, the Board, the police or a bank. We tell you what is realistic once the facts are known.

Before the next incident

Have the response arranged before you need it.

Cyber Surety for organisations is a membership, not insurance: incident response, the legal track, a red-team assessment and DPDP compliance support, priced after an initial scan. Cyber-loss cover included, up to plan limits. T&C apply.

What is Cyber Surety?Fake accounts using your brand

An individual, not a business? See cyber crime investigation, complaint filing or cyber help by situation on VirtualVakil.

FAQs

An incident response team and a lawyer, at the same time. If you have neither, message the Codesnag cyber team on WhatsApp at +91 83682 43183 or report at codesnag.ai/report-incident; we aim to call back within one hour. Isolate affected machines without switching them off, and do not wipe or restore anything until the evidence is preserved.

The CERT-In Directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and Government organisations. The IT Act, in S. 43A, explains a body corporate as including a company, a firm or a sole proprietorship engaged in commercial or professional activities, so most businesses should plan on the 6-hour rule applying to them.

From when you noticed the incident or it was brought to your notice. That is why the time you noticed it should be written down at once.

The 20 types listed in Annexure I of the Directions, including unauthorised access to IT systems or data, ransomware and other malicious code, phishing and identity theft, data breaches and data leaks, attacks on servers, website defacement, DDoS attacks, attacks on cloud systems and unauthorised access to social media accounts.

DPDP Act S. 8(6) requires the Data Fiduciary to inform the Data Protection Board and each affected person. Under Rule 7 of the DPDP Rules, 2025, affected people must be told without delay what happened, the likely consequences, what is being done and what they can do; the Board must be told without delay, with a detailed report within 72 hours. These duties commence on 13 May 2027 under the November 2025 notifications; check for any later change before relying on the date.

That is a decision to take with your lawyer, after the facts are known. Payment does not guarantee decryption or the deletion of stolen data, and it has legal and insurance consequences. Do not reply to the attacker until you have advice.

No. What can be recovered depends on backups, how far the attacker got, how quickly money transfers were reported and the banks involved. We tell you what is realistic once the facts are known.

The first call is free, and we quote once we know the scope. Organisations that want this response arranged before the next incident can take the Cyber Surety membership for organisations, which is priced after an initial scan.

Primary sources

Where these rules come from

Last reviewed 19 Oct 2026. General information, not legal advice for your organisation. If anything here differs from the official text, the official text prevails. Codesnag and VirtualVakil are not CERT-In, the Data Protection Board or the police. codesnag.ai is a unit of Cyber Legal Intelligence Partners.

Something has happened?

Tell us what you know so far. We aim to call back within one hour.

Report an incident WhatsApp now