India was the most targeted country in Asia-Pacific for ransomware in August 2026, with 24 of the region's 143 publicly claimed victims, according to Cyble's monthly Ransomware Brief, reported on 28 September 2026. Worldwide, 1,034 victims were claimed, the highest monthly total of 2026. Thailand (17), Taiwan (16) and Japan (11) followed India. The figures count victims named on criminal leak sites, so they measure what attackers choose to publicise, not every incident. They still show where pressure is building.
What the brief actually found
Two patterns matter for policy. First, Cl0p-linked affiliates are exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, software used by manufacturers and engineering firms. Cyble's brief says they steal design files and supply-chain records instead of encrypting systems, which can evade endpoint tools built to spot encryption behaviour. More than 40 organisations have been publicly named. Second, the Akira group keeps using CVE-2024-40766, a SonicWall SSL VPN flaw that is about two years old and already patched. As Cyble's Daksh Nakra put it, attackers are "walking in through vulnerabilities that were patched two years ago."
Neither pattern is exotic. One is extortion that never needs ransomware code. The other is basic patch hygiene.
The case for tougher rules
The strongest argument for a harder line is that India's current regime is built around reporting, not deterrence. Under the CERT-In Directions issued on 28 April 2022 under Section 70B(6) of the IT Act, covered entities must report incidents within six hours of noticing them. A Trilegal summary notes that the earlier 2013 rules set no fixed deadline and that the Directions added "data breach" and "data leak" to the reportable list. Advocates of a ransom-payment ban or mandatory disclosure of payments argue that, without them, payments quietly finance the next campaign, and regulators cannot see how often victims pay. That is a fair concern: a reporting rule tells CERT-In an incident happened, not whether the victim paid or what it cost.
Where the gaps are
The news hook raises three real questions.
- Does the six-hour clock fit data-theft extortion? The Directions' reportable list covers data breaches and leaks, so an exfiltration-only campaign like the Windchill one should fall inside it in principle. The practical problem is detection. Victims of non-encrypting extortion often learn of the theft only when the attacker contacts them or posts their name. The six-hour clock then starts late, and a rule meant to give CERT-In early warning arrives after the leak site does. CERT-In could clarify how it treats a leak-site listing as the moment of "being brought to notice."
- Is there a ransom-payment policy? I found nothing on ransom payments in the Directions or in coverage of them, and the research material for this piece describes no such policy. On the evidence available to me, India has neither a payment ban nor a payment-reporting duty.
- Who answers for the personal data? The Digital Personal Data Protection Act, 2023 requires a data fiduciary to inform the Data Protection Board and affected people of a breach "in prescribed manner," and sets penalties of up to Rs 250 crore for failing to take reasonable security safeguards, according to PRS Legislative Research. That gives firms a financial reason to patch. It is a stronger incentive than any reporting deadline, though enforcement will determine whether it works.
Why a payment ban is the wrong answer
Bans sound decisive but carry costs. A hospital or a manufacturer facing a stolen-data threat may judge payment the least-bad option, and a ban pushes those payments underground, which removes the visibility regulators need. It also does little against data-theft extortion, where the victim pays to suppress publication, not to unlock systems. A narrower tool would work better: a confidential duty to tell CERT-In if a ransom was demanded or paid, with a no-penalty, no-publicity safe harbour so firms report honestly. This keeps the six-hour rule's intelligence purpose while adding the one data point India lacks.
What proportionate policy looks like
The cheapest intervention is the least glamorous. A two-year-old patched VPN flaw should not be a way into Indian networks. CERT-In already issues advisories; on 15 October 2026 it rated a separate AI-agent threat critical, citing exposed credentials, insecure APIs and excessive cloud permissions. That points the same way: basic hygiene is the control that fails most often. Regulators could publish a short list of actively exploited vulnerabilities that critical-sector operators must patch within a set window, and pair it with technical help for smaller firms that lack security teams.
India's ranking is a single month's snapshot, and one month does not make a trend. But it arrives as extortion is shifting from encryption to theft, which is where reporting rules written around incident discovery work least well. Fixing the trigger for the six-hour clock, adding confidential payment reporting, and enforcing patch hygiene would address the actual failure modes without criminalising victims.