pwnsycybersecurity + privacy community
Hand-checked sources

India Cyber Watch

Threat levelNo public level foundChecked 7 Nov 2026
9✅ confirmed2⚠️ claimed1🔗 via a vendor
All 11 incidents

Reports since 1 Jan 2026. Not a live feed.

Threat level, India

Background readingHacktivismIncident response

Threat level

No public level found

No published national cyber threat level found for India, checked 7 Nov 2026. India publishes no national cyber threat level; CERT-In signals risk through dated alerts, advisories and vulnerability notes.

Source: CERT-In

Compare countries

CountryThreat levelConfirmedClaimed onlyVia a vendorLatest report
MalaysiaMedium193577 Nov 2026
SingaporeNone published122437 Nov 2026
IndonesiaNone published63205 Nov 2026
ThailandNone published93303 Nov 2026
PhilippinesNone published93547 Nov 2026
VietnamNone published53405 Nov 2026
IsraelNone published4207 Nov 2026
IranNone published40013 Jun 2026
United Arab EmiratesNone published4417 Oct 2026
Saudi ArabiaNone published25012 Oct 2026
EgyptNone published14129 Oct 2026
South AfricaNone published80126 Oct 2026
NigeriaNone published2308 Aug 2026
KenyaNone published16025 Jul 2026
IndiaNone published92128 Oct 2026
PakistanNone published33022 Jul 2026
BangladeshNone published15023 Oct 2026
Sri LankaNone published4311 Jul 2026
CambodiaNone published03010 Jun 2026
MyanmarNone published15025 Oct 2026
BruneiNone published000
PolandBRAVO-CRP5041 Oct 2026
UkraineNone published7014 Nov 2026
RussiaNone published7011 Nov 2026
CzechiaNone published30122 Oct 2026
RomaniaNone published20014 Jul 2026
EstoniaNone published5034 Nov 2026
TurkeyNone published30116 Sep 2026
United KingdomNone published5132 Nov 2026
GermanyNone published4012 Nov 2026
FranceNone published7024 Nov 2026
NetherlandsNone published5112 Nov 2026
ItalyNone published5007 Nov 2026
SpainNone published3005 Feb 2026
IrelandNone published3402 Nov 2026
SwedenNone published5322 Nov 2026
United StatesNone published60228 Aug 2026
CanadaNone published50121 Aug 2026
MexicoNone published24121 Aug 2026
BrazilNone published2202 Nov 2026
ArgentinaNone published1204 Aug 2026
ChileNone published1202 Nov 2026
ColombiaNone published1204 Nov 2026
JapanNone published9054 Nov 2026
South KoreaCaution60229 Oct 2026
ChinaNone published0307 Aug 2026
TaiwanNone published9023 Nov 2026
Hong KongNone published30330 Oct 2026
AustraliaNone published5012 Nov 2026
New ZealandNone published7213 Sep 2026

2026 counts. Click a row to open a country.

Official numbers

MeasureValuePeriodSource
Cyber incidents handled by CERT-In29.44 lakh (about 2.94 million)2025BizzBuzz, citing government statement of 23 Jan 2026
Alerts issued by CERT-In1,5302025BizzBuzz, citing government statement of 23 Jan 2026
Vulnerability notes issued by CERT-In3902025BizzBuzz, citing government statement of 23 Jan 2026

Who is targeting it

GroupKindWhat it didSourcesReports
World LeaksExtortionClaimed Reliance Group in June 2026 and posted Tata Electronics files the same month.Business Recorder (Reuters) · DeXposeProfile
VectRansomwareClaimed ApexHospitals in February 2026.DeXpose

Laws and rules this year

  1. 13 Nov 2026DPDP Rules 2025, second phase. Section 6(9) and section 27(1)(d) of the DPDP Act take effect one year after the Rules were notified, covering Consent Manager provisions; remaining duties follow on 13 May 2027. Source

Full stories

Official statements

  1. 28 Apr 2026CERT-In issued a high-severity advisory on frontier AI driven cyber risks and urged faster patching and log retention. Free Press Journal
  2. 23 Jan 2026Government said CERT-In handled 29.44 lakh cyber incidents in 2025 and issued 1,530 alerts. BizzBuzz

Incidents

11 of 11 incidents

What happenedSources
✅ ConfirmedIntellect Design Arena28 Oct 2026FinanceIntrusionNone

Confirmed. The banking software company told the exchanges that an employee email account at its Canadian subsidiary was compromised and used to send fake payment instructions to a customer. It reported no impact on its products or operations.

NSE filing✓ 8 Nov
✅ ConfirmedKamalnayan Bajaj Hospital28 Oct 2026HealthRansomware

Confirmed. A ransomware attack detected on 18 October hit all nine servers at the Chhatrapati Sambhajinagar hospital, forcing staff onto manual processes. Police registered a case.

Claimed. A ransom note attributed to Crypto24 Group said hospital files were encrypted.

Medical Dialogues✓ 8 Nov
✅ ConfirmedBank of Baroda27 Jul 2026FinanceData leakNone

Confirmed. The state-owned bank said a business email compromise gave unauthorised access to certain data through an employee's email account. It said core banking systems were not accessed and ordered a forensic probe.

Claimed. A threat actor claimed to have published about 1 TB of the bank's data on the dark web.

Business Today · Moneylife✓ 8 Nov
✅ ConfirmedBajaj Auto23 Jun 2026ManufacturingRansomwareNone

Confirmed. Bajaj Auto told the stock exchanges that ransomware hit IT systems at its subsidiary Bajaj Auto Technology Limited and that it notified CERT-In.

Whalesbook✓ 7 Nov
✅ ConfirmedTata ElectronicsVia a vendor22 Jun 2026ManufacturingRansomware

Confirmed. Tata Electronics said it detected a cybersecurity incident on some systems and that its operations were unaffected.

Claimed. World Leaks posted files it said included Apple and Tesla component designs, over 630 GB in total.

Business Recorder (Reuters) · Gujarat Samachar✓ 7 Nov
⚠️ ClaimedReliance Group11 Jun 2026OtherRansomware

Claimed. World Leaks listed Reliance Group on its leak site and said critical data had been encrypted.

DeXpose✓ 7 Nov
✅ ConfirmedUltrahuman4 Jun 2026HealthData leakNone

Confirmed. The Bengaluru wearables maker said an attacker used credentials stolen from an employee's device to reach an internal analytics system on 27 March. About 0.1 per cent of users were affected; passwords and payment data were not.

Digit · GSMArena✓ 8 Nov
✅ ConfirmedHDFC Asset Management Company18 May 2026FinanceIntrusionNone

Confirmed. HDFC AMC disclosed a cyber security incident on 16 May after an anonymous source claimed access to parts of its IT infrastructure. It activated containment and hired a specialist firm, and said operations were unlikely to be affected.

Free Press Journal (IANS)✓ 8 Nov
✅ ConfirmedOmax Autos27 Mar 2026ManufacturingRansomwareNone

Confirmed. The auto parts maker told the exchanges a suspected incident on 26 March was confirmed as a ransomware attack on its IT infrastructure. It said core systems and operations were not affected.

NSE filing✓ 8 Nov
⚠️ ClaimedApexHospitals24 Feb 2026HealthData leak

Claimed. Vect said it stole and leaked employee payroll records and patient medical records.

DeXpose✓ 7 Nov
✅ ConfirmedKopran20 Feb 2026ManufacturingIntrusionNone

Confirmed. The listed drugmaker told BSE and NSE that an unauthorised person accessed computer server data at its Khopoli factory. It restricted access and brought in cyber security experts.

NSE filing✓ 8 Nov

FAQ

Does India have a national cyber threat level?

No published national cyber threat level was found for India (checked 7 Nov 2026). India publishes no national cyber threat level; CERT-In signals risk through dated alerts, advisories and vulnerability notes.

Which organisations in India confirmed cyber incidents recently?

9 incidents confirmed since January 2026: Intellect Design Arena, Kamalnayan Bajaj Hospital, Bank of Baroda, Bajaj Auto, Tata Electronics, Ultrahuman, HDFC Asset Management Company, Omax Autos and Kopran.

Which India organisations appear on ransomware or leak sites?

2 claims, not confirmed by the organisations: Reliance Group and ApexHospitals.

What counts as a confirmed incident?

The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.

Why list leak-site claims at all?

Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.

Is the map a live attack feed?

No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.

How often is it updated?

By hand when a national level changes or a notable incident is reported. The date is shown in the header.

Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.