My Aurangabad business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

In the event that your business computers in Aurangabad are locked by ransomware, it is advisable to report the incident to law enforcement rather than paying the ransom.

Here are the main reasons and steps you should consider:

• Legal Implications: Paying a ransom may not guarantee the recovery of your data and could potentially be illegal under the Unlawful Activities (Prevention) Act, 1967. Funding criminal enterprises could lead to further legal complications.
• Reporting Obligations: Under the Information Technology Act, 2000, specifically Section 66, if a computer resource is compromised, it is mandatory to report it to the authorities, especially if it affects a larger public interest.
• Contacting Law Enforcement: Report the ransomware attack to the local police station or the Cyber Crime Cell. This can help in tracking down the attackers and may assist in recovering your data. In Maharashtra, you can contact the Maharashtra Cyber cell at their helpline number or website.
• Documenting Evidence: Before taking any action, document all evidence related to the attack, such as screenshots, ransom notes, and any communication with the attackers. This information will be crucial for law enforcement and cybersecurity experts.
• Engaging Cybersecurity Experts: Hire professionals to analyze the attack, assess the damage, and possibly recover your data without paying the ransom. They can also help strengthen your systems against future attacks.
• Informing Stakeholders: Notify relevant stakeholders (employees, clients, partners) about the breach, particularly if personal data was compromised, in compliance with Section 43A of the IT Act, which mandates data protection responsibilities.
• Reviewing Cybersecurity Policies: Post-incident, review and improve your cybersecurity measures, including backups, employee training, and incident response plans to minimize the risk of future attacks.

In summary, do not pay the ransom as it may complicate matters further. Instead, prioritize reporting the incident, documenting evidence, and seeking professional help to recover your systems.