My Bareilly clinic's computers were encrypted by ransomware and the attackers are demanding ₹5 lakh. What should I do?

Detailed Legal Analysis

If your Bareilly clinic's computers have been encrypted by ransomware and attackers are demanding ₹5 lakh, it is essential to take decisive actions to mitigate the situation and protect your interests.

Follow these steps to address the ransomware attack:

• Do Not Pay the Ransom: Paying the ransom does not guarantee that you will regain access to your data and may encourage further attacks.
• Isolate Affected Systems: Immediately disconnect all affected computers and networks from the internet to prevent further spread of the ransomware.
• Assess the Damage: Determine which files or systems have been affected and whether any backups are available that can be restored.
• Report the Incident:
  • File a complaint with the Cyber Crime Cell in Bareilly. According to the Information Technology Act, 2000, section 66, unauthorized access to a computer resource is a punishable offense.
  • Contact local law enforcement to report the crime, which is crucial for any potential investigation.
• Consult Cybersecurity Experts: Engage with cybersecurity professionals who can help you understand the nature of the attack, recover data if possible, and secure your systems against future incidents.
• Notify Affected Parties: If patient data has been compromised, you may be required to inform affected patients as per the provisions of the Personal Data Protection Bill (PDPB), which emphasizes data breach notification.
• Implement Preventative Measures:
  • Regularly backup your data to secure locations.
  • Enhance your cybersecurity protocols, including firewalls, antivirus software, and employee training on phishing and other cyber threats.

Additionally, keep thorough records of the incident, including all communications with the attackers, as this documentation may be valuable for law enforcement and potential legal actions. Under the IT Act, 2000, unauthorized data access and cyber extortion are serious offenses, and cooperating with authorities can help in pursuing legal action against the perpetrators.

Stay informed about the evolving legal landscape concerning cyber laws in India, as the Personal Data Protection Bill may soon introduce more stringent regulations on data breaches and cybersecurity obligations.