Quick action card
Ransomware Attack in India 2026: What To Do
Hit by ransomware in India? Do not pay. Disconnect, save evidence, report to 1930 and cybercrime.gov.in. Free decryption tools and prevention basics.
Free to share, no credit needed. The card carries 1930 and the source address, so it still helps someone after it has been forwarded and nobody remembers where it came from.
Do this now
The first four steps, in order
- 1
Disconnect immediately
Unplug the cable, turn off Wi-Fi. Stop it spreading.
- 2
Do not pay, delete nothing
Keep the note and the encrypted files. Some have free decryptors.
- 3
Protect the backups
Unplug external drives that were not already connected.
- 4
Call 1930 and report to CERT-In
Organisations must report within 6 hours.
1930 is the national cyber crime helpline, 24/7. Reporting fast is the single biggest factor in getting money back. Call now
Tap or click to download