Ransomware
Malware that locks or encrypts a victim’s data and demands payment to restore it.
Ransomware is malicious software that locks or scrambles your files, and often copies them first, then demands money to unlock them or to keep them from being published.
Meaning of Ransomware
A ransomware attack is a personal data breach because it compromises availability, and often confidentiality when data is stolen first. Tested backups and strong access control reduce the damage.
Ransomware is a family of malware that encrypts files, databases or whole servers and displays a demand, usually for payment in cryptocurrency. Modern attacks rarely stop at locking. Many groups first copy large volumes of data and then threaten to publish it, a method often called double extortion. Entry points include phishing emails, stolen or guessed remote-access credentials, unpatched internet-facing servers and compromised vendor accounts. Attackers often sit inside a network for days or weeks before triggering encryption.
Under the DPDP Act, a ransomware attack on systems holding personal data is almost certainly a personal data breach. Section 2(u) covers loss of access to personal data and anything that compromises confidentiality, integrity or availability, so encryption alone can qualify even if nothing was stolen. If data was also copied, confidentiality is compromised too. Section 8(6) and Rule 7 then require intimation to the Board and affected Data Principals, and Section 8(5) with Rule 6 expects safeguards such as access control, monitoring, logs and backups that allow processing to continue.
Other duties pile on. CERT-In directions expect cyber incidents of this kind to be reported within six hours, and sector regulators such as RBI or IRDAI may require their own notices. There is no rule in the DPDP Act that bans or permits paying a ransom, and payment may carry sanctions, insurance and reputational issues, so take legal advice before considering it. Payment does not guarantee that data is restored or deleted, and it does not remove the duty to notify.
Ransomware differs from other malware because it creates immediate operational harm. A hospital cannot access patient histories, a school cannot take attendance, and a logistics firm cannot dispatch. That is why availability is as important as secrecy in data protection thinking, and why recovery planning belongs in the same conversation as prevention. It also differs from a simple data leak: a leak is about exposure, while ransomware is about both exposure and loss of control.
Examples of Ransomware
A hospital finds its patient system locked and a ransom note on screen.
A hospital's patient system is encrypted on a Sunday night. Staff move to paper charts, the IT team restores from an offline backup in two days, and the hospital notifies patients whose records were also copied, as shown by the attackers' leak-site post.
A retailer's warehouse software stops working after an attacker uses a stolen vendor login. Network segmentation keeps the customer database separate, so only inventory is locked, and the retailer restores from backups without paying.
A school's office computer is infected after a staff member opens a fake fee-receipt attachment. The attacker steals admission files before encrypting them. The school reports to CERT-In, notifies parents and the Board, and moves records to a hardened system.
Why Ransomware matters
The penalty exposure is heavy: the Schedule allows up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. Beyond fines come downtime, recovery costs, legal claims, lost revenue and damaged trust. Small and mid-sized organisations are frequent targets because attackers expect weaker defences.
For individuals, the harm is real: medical, financial or identity information can surface on leak sites and be used for fraud, harassment or targeted scams. This is why prompt, plain intimation to affected people matters, and why the Board will want to see what you did to prevent and contain the attack.
How it works in practice
- 1Keep tested, offline or immutable backups. Follow a rule such as three copies on two media with one kept offline, and test full restores regularly. Backups that cannot be restored, or that are reachable from the same network as production, are often encrypted too.
- 2Close the common doors. Enforce multi-factor authentication on email, VPN and administrator accounts, patch internet-facing systems quickly, disable unneeded remote desktop exposure, and filter email for malicious attachments and links.
- 3Limit the blast radius. Segment networks, give each user and service only the access needed, and monitor for unusual mass file changes or large outbound transfers using endpoint detection tools and logs retained for at least a year.
- 4Prepare a ransomware playbook inside the incident response plan: isolate affected machines at once, preserve evidence, engage forensic and legal help, decide who communicates, and rehearse the scenario in a tabletop exercise.
- 5If an attack occurs, assess what personal data was encrypted or copied, send the CERT-In report, intimate affected people and the Board under Rule 7, and record decisions in the breach register.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on backups without testing a restore. Run a full recovery drill so you know how long it takes and whether the data is intact.
Treating an attack with no proof of theft as not a breach. Loss of access to personal data can itself meet the definition, so assess it properly.
Paying quickly to make the problem go away. Payment gives no guarantee and does not end your notification duties, so consult counsel and law enforcement first.
Restoring systems before preserving evidence. Take forensic images and logs first, otherwise you may never learn how attackers got in.
Compliance tips
Keep at least one backup copy where ordinary admin credentials cannot reach it, such as offline media or immutable cloud storage.
Treat vendor and remote-access accounts as high risk and require MFA for them, since they are a favourite route in.
Print the incident contact list and ransomware steps, because email and shared drives may be unavailable during an attack.
Common questions about Ransomware
Is a ransomware attack a personal data breach under the DPDP Act?
Usually yes. Section 2(u) covers loss of access to personal data and compromise of confidentiality, integrity or availability. If systems holding personal data were encrypted or the data copied, notification duties under Section 8(6) and Rule 7 are likely to arise, subject to legal assessment.
Does the DPDP Act say whether we can pay the ransom?
No. The Act neither bans nor permits payment. Other laws, insurance terms and sanctions rules may be relevant, so take legal advice. Paying does not remove your duty to protect personal data or to notify the Board and affected people.
How do backups help against ransomware?
Tested backups that attackers cannot reach let you restore without paying. Rule 6 expects measures for continued processing if availability is compromised. Backups do not address stolen data, though, so you still need prevention, monitoring and notification plans.