The first 72 hours after a cybercrime incident are the most critical — and the most commonly mishandled. The three immediate priorities are: preserve all potentially relevant evidence without disturbing it, restrict further access to compromised systems without wiping or resetting them, and engage legal counsel before making any public statement, notifying any counterparty, or approaching law enforcement. Acting without legal guidance in the immediate aftermath of an incident frequently results in the inadvertent destruction of evidence, premature disclosure that alerts perpetrators, and the foreclosure of recovery and enforcement options that would otherwise have been available.

Recovery is possible — but it is time-sensitive and depends on the speed and structure of the legal response. Funds transferred through domestic bank accounts can often be frozen through court orders and law enforcement action if the response is initiated quickly. Cross-border recovery is more complex but remains achievable through mutual legal assistance mechanisms and coordinated civil proceedings in relevant jurisdictions. We assess the realistic recovery prospects in every matter at the outset and advise honestly on the options available given the specific facts of the incident.

It depends on the nature of the incident. Under the Digital Personal Data Protection Act, 2023, a personal data breach must be notified to the Data Protection Board — and, in prescribed circumstances, to affected data principals — within a specified timeframe. Certain regulated entities also have sector-specific reporting obligations to their regulators. Criminal reporting to the Cyber Crime Cell is not legally mandatory in most cases but is often strategically advisable. We assess your specific notification and reporting obligations at the outset of every engagement and manage compliance with all applicable requirements.

A John Doe order — also known as an Ashok Kumar order in Indian jurisprudence — is a court order directed against an unknown defendant, allowing a party to obtain relief against an unidentified perpetrator and to compel third parties such as platforms, internet service providers, and financial institutions to disclose identity and transaction information that can be used to unmask the perpetrator. John Doe orders are particularly valuable in cybercrime matters where the identity of the perpetrator is unknown but their digital footprint — IP addresses, email accounts, transaction records — can be traced through third-party disclosure.

Yes — and in an environment of increasing cybercrime risk, doing so is commercially prudent. We advise on the incorporation of cybercrime response obligations, data breach notification protocols, liability allocation provisions, and indemnity clauses into commercial contracts, vendor agreements, and technology arrangements — ensuring that your contractual framework reflects and supports your cybercrime risk management posture rather than creating additional exposure in the event of an incident.