India Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, India
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for India, checked 7 Nov 2026. India publishes no national cyber threat level; CERT-In signals risk through dated alerts, advisories and vulnerability notes.
Source: CERT-In
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
| Medium | 19 | 35 | 7 | 7 Nov 2026 | |
| None published | 12 | 24 | 3 | 7 Nov 2026 | |
| None published | 6 | 32 | 0 | 5 Nov 2026 | |
| None published | 9 | 33 | 0 | 3 Nov 2026 | |
| None published | 9 | 35 | 4 | 7 Nov 2026 | |
| None published | 5 | 34 | 0 | 5 Nov 2026 | |
| None published | 4 | 2 | 0 | 7 Nov 2026 | |
| None published | 4 | 0 | 0 | 13 Jun 2026 | |
| None published | 4 | 4 | 1 | 7 Oct 2026 | |
| None published | 2 | 5 | 0 | 12 Oct 2026 | |
| None published | 1 | 4 | 1 | 29 Oct 2026 | |
| None published | 8 | 0 | 1 | 26 Oct 2026 | |
| None published | 2 | 3 | 0 | 8 Aug 2026 | |
| None published | 1 | 6 | 0 | 25 Jul 2026 | |
| None published | 9 | 2 | 1 | 28 Oct 2026 | |
| None published | 3 | 3 | 0 | 22 Jul 2026 | |
| None published | 1 | 5 | 0 | 23 Oct 2026 | |
| None published | 4 | 3 | 1 | 1 Jul 2026 | |
| None published | 0 | 3 | 0 | 10 Jun 2026 | |
| None published | 1 | 5 | 0 | 25 Oct 2026 | |
| None published | 0 | 0 | 0 | ||
| BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 | |
| None published | 7 | 0 | 1 | 4 Nov 2026 | |
| None published | 7 | 0 | 1 | 1 Nov 2026 | |
| None published | 3 | 0 | 1 | 22 Oct 2026 | |
| None published | 2 | 0 | 0 | 14 Jul 2026 | |
| None published | 5 | 0 | 3 | 4 Nov 2026 | |
| None published | 3 | 0 | 1 | 16 Sep 2026 | |
| None published | 5 | 1 | 3 | 2 Nov 2026 | |
| None published | 4 | 0 | 1 | 2 Nov 2026 | |
| None published | 7 | 0 | 2 | 4 Nov 2026 | |
| None published | 5 | 1 | 1 | 2 Nov 2026 | |
| None published | 5 | 0 | 0 | 7 Nov 2026 | |
| None published | 3 | 0 | 0 | 5 Feb 2026 | |
| None published | 3 | 4 | 0 | 2 Nov 2026 | |
| None published | 5 | 3 | 2 | 2 Nov 2026 | |
| None published | 6 | 0 | 2 | 28 Aug 2026 | |
| None published | 5 | 0 | 1 | 21 Aug 2026 | |
| None published | 2 | 4 | 1 | 21 Aug 2026 | |
| None published | 2 | 2 | 0 | 2 Nov 2026 | |
| None published | 1 | 2 | 0 | 4 Aug 2026 | |
| None published | 1 | 2 | 0 | 2 Nov 2026 | |
| None published | 1 | 2 | 0 | 4 Nov 2026 | |
| None published | 9 | 0 | 5 | 4 Nov 2026 | |
| Caution | 6 | 0 | 2 | 29 Oct 2026 | |
| None published | 0 | 3 | 0 | 7 Aug 2026 | |
| None published | 9 | 0 | 2 | 3 Nov 2026 | |
| None published | 3 | 0 | 3 | 30 Oct 2026 | |
| None published | 5 | 0 | 1 | 2 Nov 2026 | |
| None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyber incidents handled by CERT-In | 29.44 lakh (about 2.94 million) | 2025 | BizzBuzz, citing government statement of 23 Jan 2026 |
| Alerts issued by CERT-In | 1,530 | 2025 | BizzBuzz, citing government statement of 23 Jan 2026 |
| Vulnerability notes issued by CERT-In | 390 | 2025 | BizzBuzz, citing government statement of 23 Jan 2026 |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| World Leaks | Extortion | Claimed Reliance Group in June 2026 and posted Tata Electronics files the same month. | Business Recorder (Reuters) · DeXpose | Profile |
| Vect | Ransomware | Claimed ApexHospitals in February 2026. | DeXpose |
Laws and rules this year
- 13 Nov 2026DPDP Rules 2025, second phase. Section 6(9) and section 27(1)(d) of the DPDP Act take effect one year after the Rules were notified, covering Consent Manager provisions; remaining duties follow on 13 May 2027. Source
Full stories
Official statements
- 28 Apr 2026CERT-In issued a high-severity advisory on frontier AI driven cyber risks and urged faster patching and log retention. Free Press Journal
- 23 Jan 2026Government said CERT-In handled 29.44 lakh cyber incidents in 2025 and issued 1,530 alerts. BizzBuzz
Incidents
11 of 11 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| 28 Oct 2026 | Finance | Intrusion | None | Confirmed. The banking software company told the exchanges that an employee email account at its Canadian subsidiary was compromised and used to send fake payment instructions to a customer. It reported no impact on its products or operations. | NSE filing✓ 8 Nov | |
| ✅ ConfirmedKamalnayan Bajaj Hospital | 28 Oct 2026 | Health | Ransomware | Confirmed. A ransomware attack detected on 18 October hit all nine servers at the Chhatrapati Sambhajinagar hospital, forcing staff onto manual processes. Police registered a case. Claimed. A ransom note attributed to Crypto24 Group said hospital files were encrypted. | Medical Dialogues✓ 8 Nov | |
| ✅ ConfirmedBank of Baroda | 27 Jul 2026 | Finance | Data leak | None | Confirmed. The state-owned bank said a business email compromise gave unauthorised access to certain data through an employee's email account. It said core banking systems were not accessed and ordered a forensic probe. Claimed. A threat actor claimed to have published about 1 TB of the bank's data on the dark web. | Business Today · Moneylife✓ 8 Nov |
| 23 Jun 2026 | Manufacturing | Ransomware | None | Confirmed. Bajaj Auto told the stock exchanges that ransomware hit IT systems at its subsidiary Bajaj Auto Technology Limited and that it notified CERT-In. | Whalesbook✓ 7 Nov | |
| 22 Jun 2026 | Manufacturing | Ransomware | Confirmed. Tata Electronics said it detected a cybersecurity incident on some systems and that its operations were unaffected. Claimed. World Leaks posted files it said included Apple and Tesla component designs, over 630 GB in total. | Business Recorder (Reuters) · Gujarat Samachar✓ 7 Nov | ||
| ⚠️ ClaimedReliance Group | 11 Jun 2026 | Other | Ransomware | Claimed. World Leaks listed Reliance Group on its leak site and said critical data had been encrypted. | DeXpose✓ 7 Nov | |
| 4 Jun 2026 | Health | Data leak | None | Confirmed. The Bengaluru wearables maker said an attacker used credentials stolen from an employee's device to reach an internal analytics system on 27 March. About 0.1 per cent of users were affected; passwords and payment data were not. | Digit · GSMArena✓ 8 Nov | |
| 18 May 2026 | Finance | Intrusion | None | Confirmed. HDFC AMC disclosed a cyber security incident on 16 May after an anonymous source claimed access to parts of its IT infrastructure. It activated containment and hired a specialist firm, and said operations were unlikely to be affected. | Free Press Journal (IANS)✓ 8 Nov | |
| 27 Mar 2026 | Manufacturing | Ransomware | None | Confirmed. The auto parts maker told the exchanges a suspected incident on 26 March was confirmed as a ransomware attack on its IT infrastructure. It said core systems and operations were not affected. | NSE filing✓ 8 Nov | |
| ⚠️ ClaimedApexHospitals | 24 Feb 2026 | Health | Data leak | Claimed. Vect said it stole and leaked employee payroll records and patient medical records. | DeXpose✓ 7 Nov | |
| 20 Feb 2026 | Manufacturing | Intrusion | None | Confirmed. The listed drugmaker told BSE and NSE that an unauthorised person accessed computer server data at its Khopoli factory. It restricted access and brought in cyber security experts. | NSE filing✓ 8 Nov |
FAQ
Does India have a national cyber threat level?
No published national cyber threat level was found for India (checked 7 Nov 2026). India publishes no national cyber threat level; CERT-In signals risk through dated alerts, advisories and vulnerability notes.
Which organisations in India confirmed cyber incidents recently?
9 incidents confirmed since January 2026: Intellect Design Arena, Kamalnayan Bajaj Hospital, Bank of Baroda, Bajaj Auto, Tata Electronics, Ultrahuman, HDFC Asset Management Company, Omax Autos and Kopran.
Which India organisations appear on ransomware or leak sites?
2 claims, not confirmed by the organisations: Reliance Group and ApexHospitals.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.