My Dhanbad business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

In the case of your Dhanbad business being locked by ransomware, it is advisable to report the incident rather than paying the ransom.

Paying the ransom does not guarantee that your data will be restored and may encourage further criminal activity. Reporting the incident to authorities can help in tackling cybercrime in a more systemic way and may assist in recovering your data.

Here are the steps you should follow:

• Report to Law Enforcement: Contact the local police station and file a complaint regarding the ransomware attack. You can also approach the Cyber Crime Cell in your state. It is crucial to provide them with all relevant details about the incident.
• Notify CERT-In: The Computer Emergency Response Team of India (CERT-In) should be informed about the incident. As per the Information Technology Act, 2000, it is mandatory to report certain cyber incidents, and CERT-In can provide assistance in response and recovery processes.
• Data Backup and Recovery Plan: If you have data backups, restore your systems from these backups after ensuring that the ransomware is completely removed. Regular backups can mitigate the impact of such attacks in the future.
• Document Everything: Keep detailed records of the attack, including the ransom note, timestamps, and any communications. This documentation can be useful for investigations and for any insurance claims.
• Consult Cybersecurity Experts: Engage with cybersecurity professionals who can help you analyze the breach, secure your systems, and prevent future attacks. They can also assist in determining whether it is possible to recover your files without paying the ransom.
• Review Cyber Insurance: If you have cyber insurance, contact your insurer to understand your coverage regarding ransomware attacks. They may provide support in mitigating the damages.

Under the Information Technology Act, 2000, specifically Section 66, hacking and data breaches are punishable offenses, and reporting such incidents is essential for legal redress. Additionally, the Indian Penal Code (IPC) Sections 420 (cheating) and 469 (forgery) may also apply to ransomware attacks. Thus, reporting the incident can facilitate action against the perpetrators.

Overall, addressing the situation through legal channels and cybersecurity measures is the best course of action.