Ransomware negotiation is the process of engaging with attackers who have encrypted your systems to potentially reduce the ransom demand, buy recovery time, and evaluate whether payment is the least-damaging option — but paying is generally inadvisable because it funds criminal operations, provides no guarantee of data recovery, and may violate sanctions laws. Indian companies must weigh CERT-In reporting requirements, insurance coverage, and business survival against the ethical and legal risks of payment. Last updated October 2026.
What Is the Current Ransomware Threat Landscape in India?
India ranks among the top 5 most-targeted countries for ransomware:
- Average ransom demand: ₹50 lakh–₹5 crore for mid-sized businesses; ₹10–50 crore+ for enterprises and critical infrastructure.
- Average downtime: 22 days before full recovery (with or without payment).
- Payment rate: Approximately 30–35% of Indian organizations hit by ransomware paid the ransom in 2025, according to industry surveys.
- Common groups targeting India: LockBit variants, BlackCat/ALPHV successors, Akira, and regional threat actors.
- Sectors most affected: Healthcare, manufacturing, education, government, and BFSI (banking, financial services, insurance).
Is It Legal to Pay Ransomware in India?
India does not have a specific law that explicitly prohibits ransomware payments. However, several legal frameworks apply:
- CERT-In Directions (April 2022): Organizations must report cyber incidents including ransomware to CERT-In within 6 hours of detection. This is mandatory, regardless of whether you pay.
- Information Technology Act, 2000: While it criminalizes hacking and extortion, it doesn’t specifically address victim-side payment. However, channeling funds to designated terrorist organizations could trigger UAPA provisions.
- PMLA (Prevention of Money Laundering Act): Cryptocurrency payments to attackers could be scrutinized under anti-money-laundering provisions. Organizations should document their decision-making process thoroughly.
- International sanctions: If the ransomware group is sanctioned by OFAC (US), EU, or UN, payment could create legal liability even for Indian companies — particularly those with US clients, operations, or banking relationships.
- RBI cyber security framework: Banks and NBFCs have additional reporting and governance requirements that affect ransomware response decisions.
What Are the Arguments Against Paying?
- No guarantee of recovery: 20–30% of organizations that pay never receive a working decryption key. Some receive keys that corrupt data during decryption.
- Encourages future attacks: Payment validates the criminal business model and funds development of more sophisticated ransomware.
- Double extortion: Even after payment, attackers may sell or leak stolen data. 70%+ of ransomware attacks now include data exfiltration before encryption.
- Repeat targeting: 80% of organizations that pay are attacked again, often by the same group or their affiliates, who know the victim will pay.
- Reputational damage: Public disclosure of payment can damage customer trust more than the breach itself.
- Regulatory risk: Payment may complicate regulatory investigations and create liability under evolving Indian data protection law (DPDPA).
When Might Payment Be Considered?
Despite the strong case against paying, some scenarios make payment a survival-level consideration:
- Patient safety: Hospitals where encrypted systems directly endanger lives may have no choice but to pay for immediate decryption while recovering from backups in parallel.
- No viable backups: If backups were also encrypted or destroyed and the data is irreplaceable, payment may be the only path to recovery.
- Business survival: Small businesses facing permanent closure if operations don’t resume within days.
- Data exposure threat: When exfiltrated data includes sensitive customer information whose leak would cause greater harm than the payment amount.
How Does Ransomware Negotiation Work in Practice?
If the organization decides to engage (even without committing to pay):
- Hire a professional negotiator: Specialized firms (often recommended by cyber insurance providers) handle communications. Never negotiate directly — emotions and urgency lead to poor outcomes.
- Establish a communication channel: Most ransomware groups provide a Tor-based chat portal or email address. Document every interaction.
- Verify the threat: Request proof of decryption (test files) and proof of data exfiltration (file listings). Attackers sometimes bluff about data theft.
- Buy time: Negotiators stall for time while the technical team assesses backup viability, forensic recovery options, and alternative decryption tools.
- Negotiate the amount: Professional negotiators typically reduce demands by 40–70%. A ₹2 crore demand might settle at ₹60–80 lakh.
- If paying: Use a cryptocurrency broker experienced in ransomware payments. Ensure OFAC/sanctions screening. Document the decision chain for legal protection.
What Should Your Ransomware Response Plan Include?
- Incident response team: Pre-defined roles — IT lead, legal counsel, communications officer, executive decision-maker.
- CERT-In notification procedure: Template and process for the mandatory 6-hour reporting window.
- Legal review: Pre-engaged legal counsel who understands IT Act provisions, DPDPA requirements, and sanctions law.
- Cyber insurance: Policy that covers ransom payment, negotiation costs, business interruption, and forensic investigation. In India, cyber insurance premiums range from ₹50,000–₹5 lakh annually for mid-sized businesses.
- Backup testing: Monthly restoration tests. If you haven’t tested a restore, you don’t have backups — you have hope.
- Communication plan: Templates for customer notification, employee communication, and media statements.
- Decision framework: Pre-defined criteria for the pay/don’t-pay decision, approved by the board, so decisions aren’t made under duress.
How Do You Prevent Ransomware in the First Place?
- Immutable backups: 3-2-1 rule (3 copies, 2 media types, 1 offsite) with at least one immutable/air-gapped copy that ransomware cannot encrypt.
- Patch management: 60% of ransomware exploits known vulnerabilities. Patch critical systems within 48 hours of updates.
- Email security: Advanced email filtering, DMARC/DKIM/SPF, and phishing simulation training. 70% of ransomware enters via email.
- EDR/XDR: Endpoint detection and response tools that detect ransomware behavior (mass file encryption) and auto-isolate affected machines.
- Network segmentation: Isolate critical systems so ransomware cannot spread from a single compromised workstation to the entire network.
- Least privilege: Users should not have admin rights on workstations. Service accounts should have minimal necessary permissions.
- MFA everywhere: Multi-factor authentication on email, VPN, RDP, admin panels, and cloud services eliminates the most common initial access methods.
Frequently Asked Questions
Does CERT-In require reporting ransomware even if we don’t pay?
Yes. CERT-In’s April 2022 directions require reporting ransomware incidents within 6 hours regardless of payment. Non-reporting can result in penalties under the IT Act. Report through the CERT-In incident reporting portal or email incident@cert-in.org.in.
Does cyber insurance cover ransomware payments in India?
Most comprehensive cyber insurance policies in India cover ransom payments, negotiation costs, and business interruption. However, coverage requires compliance with minimum security standards defined in the policy. Read exclusions carefully — some policies exclude payment to sanctioned entities or incidents caused by unpatched known vulnerabilities.
Can we use free decryption tools instead of paying?
Check nomoreransom.org — a project by Europol and security firms that provides free decryptors for many ransomware variants. Also check individual security vendor tools (Kaspersky, Emsisoft, Avast). For newer or well-maintained ransomware families, free tools are rarely available, but always check before considering payment.
What is the average cost of ransomware recovery without paying?
For Indian mid-sized businesses, recovery costs (forensics, system rebuilding, business interruption, legal, and notification) average ₹50 lakh–₹2 crore — often more than the ransom demand. This is why prevention is dramatically cheaper than cure.
Should we contact law enforcement?
Yes. File an FIR with the local Cyber Crime Police Station and report to CERT-In. Contact the Indian Cyber Crime Coordination Centre (I4C) for coordination. Law enforcement agencies may have intelligence about the specific ransomware group, including whether decryption keys are available from prior seizures.
