Ransomware & crisis legal response in India — when ransomware hits, you need a lawyer before you need IT.

There is no blanket Indian law that criminalises paying a ransom outright, but the payment mechanics themselves create real legal exposure. If the payment involves foreign remittance or cryptocurrency, Section 3 of FEMA prohibits dealing in foreign exchange with unauthorised persons, and Section 10 requires accurate disclosure of the purpose of any remittance through authorised channels — a ransom payment rarely fits either requirement cleanly. The Indian government has also stated it does not support ransom payments, and separately, US OFAC sanctions can attach if the threat actor is a designated entity, which matters for any payment routed through US-linked financial infrastructure.

CERT-In's Direction under the IT Act requires notification within 6 hours of becoming aware of a cybersecurity incident, and non-compliance carries real regulatory consequences. The clock starts at awareness, not at the moment legal counsel is engaged — which is exactly why the delay between detecting an incident and calling a lawyer is the most expensive delay in the entire response.

Forensic findings produced without a legal engagement directing the work are generally not protected by attorney-client privilege, and can be compelled in a later regulatory investigation or civil claim. When forensics are conducted under attorney direction from the outset, the resulting findings are far more likely to be protected — a distinction that matters enormously if the investigation later reveals something the organisation would not want to become a matter of public record.

A pre-incident retainer means the rules of engagement, response playbook, and legal points of contact are agreed before an attack happens, not negotiated during one. SIRI Shield retainer clients receive a 2-hour response SLA, meaning legal response begins essentially simultaneously with technical response rather than after a scoping call that eats into the CERT-In notification window.

We review your policy alongside the incident as it unfolds — many policies impose their own notification deadlines and specific documentation requirements that run parallel to, and sometimes conflict with, regulatory obligations. Missing an insurer notification window can jeopardise coverage even when the underlying claim would otherwise be valid, which is why policy review happens inside the first response window, not after.

Where a client decides negotiation is the appropriate path after legal and sanctions assessment, we can conduct or oversee that negotiation under privilege, with the payment decision itself gated by the FEMA and sanctions screening described above. We do not initiate contact with a threat actor before that legal assessment is complete.