My company server in Kolkata was hacked; what legal steps should I take?

Hacking is prosecuted under Section 66 of the IT Act for unauthorised access and under Section 318(4) of the Bharatiya Nyaya Sanhita if any cheating or extortion was involved. File an FIR at the Kolkata cyber police station and notify CERT-In within six hours of the breach, as mandated by its 2022 directions.

The Digital Personal Data Protection Act, 2023 obliges you to inform affected individuals and the Data Protection Board if personal data was compromised. The Calcutta High Court can direct the police to take forensic steps and to preserve the server image before it is altered.

West Bengal Premises Tenancy Act 1997 on data protection may impose additional notification duties if the state has a specific statute. Isolate the affected server, take a forensic image, and engage a CERT-In empanelled auditor to assess the attack vector.

Preserve the access logs, the malware samples and the IP traces for the investigation.