My Ludhiana business computers were locked by ransomware; should I pay or report it?

Detailed Legal Analysis

In the event that your business computers in Ludhiana have been locked by ransomware, you should prioritize reporting the incident rather than paying the ransom.

Here are the key reasons and steps you should consider:

• Legal Obligations: Under the Information Technology Act, 2000, specifically Section 66, any unauthorized access to computer systems is a cybercrime. Reporting the incident helps law enforcement track and combat cybercrime.
• Prevention of Future Attacks: Paying the ransom does not guarantee the return of your data and may encourage cybercriminals to target you again. Reporting aids in forming a collective defense against such threats.
• Insurance and Liability: If your business has cyber insurance, reporting the incident promptly may be crucial for coverage claims. Failure to report may result in denial of claims.

Steps to take in response to a ransomware attack:

• Document Everything: Take screenshots, note down the time of the attack, and any messages or demands made by the ransomware attackers.
• Isolate Affected Systems: Disconnect the affected computers from the network to prevent further spread of the ransomware.
• Notify Your IT Team: If you have an in-house IT team or an IT service provider, inform them immediately for technical assistance.
• Report to Law Enforcement: File a complaint with the Cyber Crime Cell of the local police department or the National Cyber Crime Reporting Portal (www.cybercrime.gov.in).
• Contact Cyber Security Experts: Engage with cybersecurity professionals who can help assess the damage and recover data without paying the ransom.
• Inform Stakeholders: Notify your employees, customers, and any other relevant stakeholders about the breach, especially if sensitive data might be compromised.

Additionally, familiarize yourself with the Indian Penal Code (IPC) under Section 463, which addresses forgery, and Section 66F, which pertains to cyber terrorism. Understanding these can help you comprehend the broader implications of the attack.

Finally, consider enhancing your cybersecurity measures post-incident to prevent future occurrences, including regular data backups, employee training, and updated security software.