The first priority is evidence preservation — securing logs, network traffic data, system images, and any other digital evidence of the attack before it is overwritten or lost through routine system operations. Do not shut down affected systems without first consulting a cyber forensics specialist, as this can destroy volatile evidence. Contact your cyber incident response team and legal counsel simultaneously — legal counsel needs to be involved from the earliest stage to ensure that evidence is preserved in a forensically sound manner, that the organisation’s legal obligations including CERT-In reporting requirements are identified and met within the applicable timeframes, and that the investigation is conducted in a way that maximises the prospects of successful legal proceedings. We provide emergency cyber incident legal support and are available immediately when incidents are discovered.

The primary cyber crime offences under Indian law are contained in the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023. The IT Act offences include unauthorised access to computer systems under Section 43 and Section 66, data theft and computer-related offences under Section 43 and Section 66B, identity theft under Section 66C, cheating by impersonation using computer resources under Section 66D, violation of privacy through unauthorised capture or transmission of images under Section 66E, cyber terrorism under Section 66F, and publishing obscene material in electronic form under Section 67. The BNS additionally covers offences of cheating and fraud committed through digital means. The applicable offence depends on the specific nature of the cyber crime and the intent and conduct of the perpetrator.

Recovery of funds lost to online fraud is time-sensitive and fact-dependent — the prospects of recovery diminish rapidly as fraudulently transferred funds are moved through multiple accounts, converted to cryptocurrency, or transferred to accounts in foreign jurisdictions. The most effective immediate steps are to contact your bank and the recipient bank to request an immediate freeze on the fraudulently credited account — which is most likely to succeed in the first few hours after the transfer — and to file a complaint with the National Cyber Crime Reporting Portal and the local cyber crime police station. Legal remedies including emergency court orders for account freezing, asset attachment, and civil recovery proceedings can be pursued in parallel. We provide immediate legal support to victims of online financial fraud and move with urgency to maximise recovery prospects from the moment of engagement.

A ransomware attack — in which malicious software encrypts an organisation’s data and the attacker demands a ransom for the decryption key — gives rise to criminal offences under the IT Act including unauthorised access, computer damage, and extortion under the BNS. The organisation that has suffered the ransomware attack has reporting obligations to CERT-In under the 2022 Directions if the incident falls within the specified categories of reportable incidents, and may also have data breach notification obligations under the DPDP Act if personal data has been compromised. The decision whether to pay the ransom is legally complex — payment to certain threat actors may engage sanctions laws, and payment does not guarantee data recovery or the non-publication of stolen data. We advise ransomware victims on the full range of legal, regulatory, and strategic considerations involved in the incident response, in parallel with the technical response.

Digital evidence — including electronic records, computer output, electronic communications, and metadata — is admissible in Indian courts subject to the requirements of the Information Technology Act and the Indian Evidence Act as amended. The admissibility of electronic records depends on the production of a certificate under Section 65B of the Evidence Act — which certifies that the electronic record was produced from a computer system that was operating properly, that the information was stored in the ordinary course of the system’s activities, and that the output accurately reflects the stored information. The Section 65B certificate requirement is one of the most technically and procedurally demanding aspects of cyber crime litigation, and the failure to obtain and produce a properly constituted certificate can result in critical electronic evidence being excluded. We advise on the collection, preservation, and production of digital evidence in a manner that satisfies every applicable admissibility requirement.