Ransomware in India: Why SMEs Are in the Frame and How to Prepare

Cyble's ransomware report for August 2026, published on 30 September, found that India had 24 claimed ransomware victims, the most of any Asia-Pacific country, out of 143 claimed across the region (roughly one in six). Worldwide there were 1,034 claimed victims, the highest monthly total of 2026, across 88 active groups.

Two cautions help read these numbers properly. First, "claimed" victims are organisations that criminal groups listed on their leak sites, which are not independently verified. Second, many attacks never appear on such lists. Still, the direction is clear: attackers are active, and Indian organisations are firmly in their sights.

How attackers get in

The report highlighted continued exploitation of older, already-patched flaws, including a SonicWall SSL VPN vulnerability from 2024 and FortiOS vulnerabilities. In other words, attackers often succeed where fixes exist but have not been applied. Another campaign described in the report stole data from manufacturing and engineering firms without encrypting anything, so "restoring from backup" would not have solved that problem.

What SMEs can do: a layered plan

Reduce the chance of entry

1. Patch internet-facing systems first: VPNs, firewalls, remote desktop servers, mail gateways and web servers. Retire devices that no longer get updates.
2. Turn on multi-factor authentication for email, VPN, admin accounts and cloud tools.
3. Close what you do not need: disable unused remote access and exposed admin panels.
4. Train staff to spot phishing, and give them an easy way to report suspicious messages.
5. Use endpoint protection on every computer and server, and keep it updated.

Limit the damage if someone gets in 6. Give people only the access they need. Admin rights should be rare and monitored. 7. Separate networks, so one infected PC cannot reach everything. 8. Encrypt and control sensitive data, and know where it lives.

Be able to recover 9. Follow the 3-2-1 rule: three copies of data, on two types of storage, with one offline or immutable. 10. Test restores regularly. A backup you have never restored is a hope, not a plan. 11. Write a one-page incident plan: who to call, who decides, how to isolate systems, how to communicate with customers and staff. 12. Keep contact details offline for your IT provider, lawyer, insurer and the authorities.

Know your reporting duties CERT-In's 2022 directions require certain cyber incidents to be reported within six hours of being noticed. Data protection rules may also apply to personal data breaches. Check current requirements with your adviser.

Should you pay a ransom?

Authorities generally advise against paying, because payment funds crime and does not guarantee recovery. Decisions should involve legal advice, your insurer and law enforcement. The best protection is not facing the choice.

Consider cyber insurance

It can help with response costs, but insurers increasingly require basics such as MFA and backups before they will cover you.

Your website and ERP matter too

Attackers target web apps and business software as well as office PCs. Keep your CMS, plugins, ERP and servers updated, restrict admin access and monitor logs.

Start this week

Pick three things: patch your edge devices, enable MFA everywhere, and test one restore. Those steps remove many of the easiest routes in.

KalzTech can review the security of your websites, Odoo ERP and hosting setup. Talk to us.