What Should an Indian Company Do After Discovering a Cybersecurity Breach?

A company cybersecurity breach can disrupt operations, expose confidential information, cause financial losses and create serious legal consequences. For an Indian business, the response must go beyond fixing compromised systems. It should also address regulatory reporting, evidence preservation, customer communication and potential liability.

Whether the incident involves ransomware, stolen employee credentials, leaked customer records or an unauthorised transfer of funds, the first few hours are critical. A structured response helps contain the damage and supports compliance with applicable Indian laws.

This guide explains what an Indian company should do after discovering a cybersecurity breach, which legal obligations may arise and how businesses can reduce further exposure.

1. Contain the Breach Immediately

The first priority is to prevent the attacker from accessing additional systems or information. The company’s IT and cybersecurity teams should identify affected devices, servers, cloud accounts and business applications. Compromised systems may need to be isolated from the network while unaffected operations continue through secure alternatives.

Reset compromised credentials, revoke suspicious sessions and strengthen access controls. Where necessary, temporarily suspend affected services or restrict access to sensitive databases. Avoid switching off, wiping or rebuilding compromised devices without specialist advice, as these actions may destroy valuable forensic evidence.

The response should be proportionate to the incident. Disconnecting every system without assessing the consequences can cause unnecessary operational disruption. A qualified incident response team should help balance containment, business continuity and evidence preservation.

2. Activate the Company’s Incident Response Team

A cybersecurity breach requires coordinated action from senior management, IT, legal, compliance, human resources and communications teams. Assign a designated incident lead to coordinate decisions, record actions and maintain a reliable timeline of events.

Engage external cybersecurity specialists where internal resources are insufficient. A forensic investigation can establish how the attacker gained access, which information was affected, whether data was transferred outside the organisation and whether unauthorised access continues.

Legal advisers should assess potential reporting duties, contractual obligations and exposure to claims. The company should also review its cyber insurance policy and notify its insurer within the applicable contractual timeframe. Delayed notification or unauthorised engagement of vendors may affect coverage.

3. Preserve Digital Evidence and Document Every Action

Evidence preservation is essential when investigating a cyber incident or considering criminal proceedings. Companies should retain relevant system logs, access records, suspicious emails, server images, security alerts, ransom messages and communications with the suspected attacker.

Maintain a record of when the breach was discovered, who was informed, which systems were affected and what containment measures were implemented. Record the source and handling of collected evidence to support its integrity and traceability.

Under the Information Technology Act, 2000 and the Bharatiya Sakshya Adhiniyam, 2023, electronic records and their proper authentication may become important in legal proceedings. Businesses should therefore ensure forensic evidence is collected and stored using appropriate procedures.

Do not delete suspicious emails, overwrite logs or negotiate with attackers through unauthorised channels. Preserve relevant evidence securely and restrict access to personnel involved in the investigation.

4. Assess the Applicable Indian Legal and Reporting Requirements

A company cybersecurity breach may trigger different obligations depending on the nature of the incident, the information involved, the company’s sector and the systems affected.

CERT-In reporting requirements

The Indian Computer Emergency Response Team (CERT-In) operates under Section 70B of the Information Technology Act, 2000. Its directions dated 28 April 2022 require covered entities, including body corporates, to report specified categories of cyber incidents within six hours of noticing them or being brought to notice of them.

Reportable categories include certain data breaches and data leaks, unauthorised access, attacks on servers and critical systems, ransomware and other specified cyber incidents. Companies should assess the incident against the applicable directions rather than assume every technical malfunction is reportable or wait for a complete forensic investigation before considering the deadline.

The directions also require covered entities to maintain specified ICT system logs securely for a rolling period of 180 days within Indian jurisdiction, alongside other applicable record keeping obligations.

Businesses should consult the official CERT-In directions and FAQs to verify the reporting process and applicable requirements. Where reporting is required, submit the available information promptly and follow up as further facts emerge.

Personal data protection obligations

A breach involving customers’ or employees’ personal information may raise additional privacy obligations. India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 establish a framework for protecting digital personal data.

However, the framework has a phased commencement schedule. As of October 2026, the principal provisions governing data fiduciaries’ breach notification obligations under Sections 8 and 33 are scheduled to commence 18 months after the November 2025 notification, in May 2027. Companies should verify the latest commencement notifications before relying on any particular provision.

In the meantime, applicable obligations under the Information Technology Act, 2000, the SPDI Rules, 2011, sector specific regulations and contractual commitments must be assessed. Businesses operating in financial services, insurance, telecommunications or other regulated sectors may have additional reporting duties.

A report to CERT-In should not automatically be treated as satisfying every other legal or contractual notification requirement.

5. Determine Whether Customers, Employees or Business Partners Must Be Notified

Once the company has a reasonable understanding of the incident, it should identify whose information or interests may have been affected. Relevant information may include customer contact details, financial records, identity documents, employee information, trade secrets or confidential business communications.

Determine whether notification is required under applicable legislation, sectoral rules, contractual arrangements or overseas privacy laws. Some business contracts require notification within a specified period, even before the full extent of a breach is known.

Communications should be accurate, timely and proportionate to the risks. Explain what happened, which categories of information may be involved, what protective steps the company has taken and what affected individuals should do next.

Avoid speculative statements, unsupported assurances or premature claims that no information was accessed. If the investigation is ongoing, distinguish confirmed facts from matters still being assessed. Keep a record of notifications and subsequent updates.

6. Report Suspected Cybercrime and Financial Fraud

A cybersecurity incident may also involve offences such as unauthorised access, identity theft, cheating, extortion or the theft of confidential information. Where criminal activity is suspected, the company should consider making a complaint to the appropriate police or cybercrime authorities.

If fraudulent transfers have occurred, contact the relevant bank and payment service provider immediately. Request urgent action to trace or restrict transactions where possible, preserve transaction records and follow the institution’s fraud reporting procedure.

Companies can use the National Cyber Crime Reporting Portal to submit appropriate complaints. For financial cyber fraud, prompt reporting through the available official channels may improve the chances of timely intervention, although recovery is not guaranteed.

Legal counsel can help determine the appropriate complaint, jurisdiction and supporting evidence. Where serious offences or significant commercial losses are involved, early coordination between investigators, forensic specialists and legal advisers can help protect the company’s position.

7. Recover Systems Securely and Review Business Continuity

Restoring operations should begin only after the company has established reasonable confidence that the immediate threat has been contained. Remove the attacker’s access, address exploited vulnerabilities, patch affected systems and reset credentials using secure procedures.

Restore data from verified backups and check them for compromise before reconnecting systems to the production environment. Introduce stronger multi factor authentication, least privilege access controls, endpoint monitoring and network segmentation where appropriate.

Review whether the incident affected business continuity, regulatory records, intellectual property or critical third party services. Communicate operational changes to employees, customers and suppliers who need the information.

Recovery should not end when systems become operational again. Monitor for recurring suspicious activity and conduct a post incident review to identify the weaknesses that enabled the breach.

8. Understand Potential Legal and Commercial Consequences

The consequences of a cybersecurity breach can extend well beyond immediate recovery costs. Depending on the facts, a company may face regulatory action, contractual claims, customer disputes, loss of business, insurance complications or allegations of inadequate security practices.

The Information Technology Act, 2000 includes provisions relevant to unauthorised access, damage to computer resources and compensation for certain failures to protect data. Criminal liability depends on the applicable offence and evidence; a company is not automatically criminally liable merely because it suffered an attack.

Businesses should review vendor agreements, confidentiality clauses, data processing arrangements, indemnities and limitations of liability. They should also assess whether the incident requires notification to directors, investors, auditors or other stakeholders.

Engaging cybersecurity lawyers for businesses can help the company assess legal exposure, reporting duties, evidence requirements and potential disputes while coordinating with technical investigators.

Where there is evidence of deliberate criminal conduct, criminal lawyers for cybercrime cases may assist with criminal complaints, investigation related issues and the protection of the company’s legal interests. Legal advice should support a fact based response, not delay urgent containment or mandatory reporting.

9. Strengthen Cybersecurity After the Incident

A breach should prompt a structured review of the company’s security and governance arrangements. Identify the root cause and determine whether weaknesses arose from outdated software, excessive access privileges, inadequate employee training, insecure vendors or insufficient monitoring.

Update incident response plans, backup procedures, access controls and vendor due diligence. Train employees to recognise phishing, impersonation attempts and suspicious requests for confidential information. Conduct periodic security assessments and test incident response procedures through realistic exercises.

Senior management should receive a clear report covering the incident’s impact, actions taken, outstanding risks and measures required to prevent recurrence. A documented improvement plan helps demonstrate accountability and strengthens organisational resilience.

Conclusion

When an Indian company discovers a cybersecurity breach, it should act quickly, preserve evidence, contain the threat, assess applicable reporting obligations and communicate responsibly with affected parties. Technical recovery and legal compliance must proceed together.

The most effective response is coordinated, evidence led and proportionate to the incident. Companies that maintain a tested response plan and obtain appropriate technical and legal support are better positioned to limit disruption, protect stakeholders and reduce future risks.