My Kochi business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

In the event of a ransomware attack on your business computers in Kochi, it is advisable to report the incident to law enforcement rather than paying the ransom.

Paying the ransom does not guarantee that you will regain access to your data and may encourage further criminal activity. Additionally, there are legal implications and obligations under Indian law that may affect your decision. Here are the key steps and considerations:

• Report the Incident: Notify the local police or the Cyber Crime Cell in Kochi. Under Section 66 of the Information Technology Act, 2000, it is illegal to extort money and reportable to authorities.
• Document Evidence: Collect and preserve all evidence related to the ransomware attack, including screenshots, emails, and any ransom notes. This documentation will be crucial for law enforcement.
• Inform Stakeholders: Depending on the severity of the attack, you may need to inform clients, customers, and employees about the breach as per the obligations under the Personal Data Protection Bill (currently in draft form, but indicative of future compliance requirements).
• Assess Data Backups: Check if you have reliable backups of your data. If so, you may be able to restore your systems without paying the ransom.
• Consult IT Experts: Involve cybersecurity professionals to analyze the extent of the damage and assist in recovering your systems safely.
• Review Cybersecurity Policies: After addressing the immediate threat, review and enhance your cybersecurity measures to prevent future attacks.

Additionally, under the Indian Penal Code (IPC), 1860, various sections related to cheating (Section 415) and criminal conspiracy (Section 120B) can be invoked against those who perpetrate ransomware attacks. This reinforces the importance of reporting the crime to the authorities.

Ultimately, while the pressure to quickly regain access to your data may tempt you to pay the ransom, it is crucial to follow a legal and strategic approach to mitigate risks and comply with applicable laws.