My Darjeeling business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

You should report the ransomware incident to the authorities rather than paying the ransom, as paying does not guarantee recovery of your data and may encourage further criminal activity.

In India, ransomware attacks fall under various provisions of cyber law, primarily governed by the Information Technology Act, 2000 and the Indian Penal Code, 1860. Here are the steps you should take if your business is locked by ransomware:

• Do Not Pay the Ransom: Paying the ransom does not guarantee that you will regain access to your data and can encourage the perpetrators to continue their criminal activities.
• Document Everything: Keep records of all messages from the attackers, the ransom amount, and any other relevant information about the attack.
• Isolate Infected Systems: Disconnect the infected computers from the network to prevent further spread of the ransomware.
• Contact Law Enforcement: Report the incident to the local police station and the Cyber Crime Cell. This is crucial as it helps in tracking and apprehending cyber criminals. Under Section 66 of the IT Act, unauthorized access to computer systems is a punishable offense.
• Notify CERT-In: The Computer Emergency Response Team (CERT-In) is the national nodal agency for responding to computer security incidents. Reporting to them can help in mitigating the risks associated with the attack.
• Engage Cybersecurity Experts: Consult with cybersecurity professionals to help recover your data and strengthen your systems against future attacks.
• Evaluate Data Backup: If you have a recent backup of your data, you may restore your systems without paying the ransom. Regularly scheduled backups are vital for business continuity.
• Review and Update Security Measures: After addressing the immediate threat, review and strengthen your cybersecurity measures to prevent future attacks. This may include updating software, enhancing firewalls, and educating employees on cybersecurity practices.

In addition to the IT Act, Section 66E of the Indian Penal Code addresses the violation of privacy, which can also be relevant in cases where sensitive data is compromised. Understanding your rights and obligations under these laws can help in protecting your business.