My Gwalior business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

In the case of a ransomware attack on your Gwalior business computers, it is advisable to report the incident rather than pay the ransom.

Paying the ransom does not guarantee that you will regain access to your data and may encourage further criminal activity. Reporting the incident helps in documenting the crime and potentially assists law enforcement in combating cybercrime. Below are the steps and considerations you should take into account:

• Document the Incident:
  • Take screenshots of the ransom note.
  • Record the time and date of the attack.
  • Note any relevant details about the ransomware, such as file extensions or messages.
• Isolate Affected Systems:
  • Disconnect infected computers from the network to prevent further spread.
  • Do not attempt to pay the ransom or communicate with the attackers.
• Report to Law Enforcement:
  • File a complaint with the Cyber Crime Cell of your local police station or use the National Cyber Crime Reporting Portal (https://cybercrime.gov.in).
  • Provide them with all relevant information and documentation.
• Notify Your IT Team:
  • Inform your IT department or a cybersecurity professional to assess the situation.
  • Work on identifying the type of ransomware to understand recovery options.
• Review Data Backup:
  • Check if you have current backups of your data that can be restored.
  • Ensure that backups are not connected to the infected systems.
• Follow Cybersecurity Protocols:
  • Implement measures to prevent future attacks, such as regular updates and employee training.
  • Consider investing in cybersecurity insurance to mitigate potential losses.

Legally, you are protected under the Information Technology Act, 2000, which governs cybercrimes and electronic commerce in India. Specifically, Section 66 of the Act pertains to computer-related offenses, including hacking and ransomware attacks. Reporting such incidents can also help in tracking and prosecuting cybercriminals effectively.

In conclusion, prioritize reporting the incident and working towards recovery rather than succumbing to ransom demands.