In October 2026, Indian ransomware fell and data leaks rose
Ransomware stops a supplier for a fortnight; a leaked customer file is sold again and again, and the bill goes to whoever collected the data.
For a CFO, that changes who pays. Ransomware stops a supplier and turns up as a late delivery. A leak lands on whoever collected the data — and from 13 May 2027 that is a statutory duty, not only a reputational one.
Between 1 October and 1 November, the BitScore Threat Monitoring service counted 55 incidents affecting Indian organisations, in 15 of the 23 industry sectors it tracks: 33 data breaches, 13 ransomware claims, seven sales of access or data, one malware campaign and one exploited vulnerability.
What changed since September
Ransomware claims fell from 21 to 13, and underground listings from sixteen to seven. Data breaches rose from 26 to 33. The total fell from 67 to 55.
Healthcare went from one incident to four, Nonprofit/NGO from none to three, and Consumer Goods from one to three. Hospitality, the busiest market for access sales in September, fell from six to one. Engineering, with four ransomware claims in September, recorded none.
No state-backed operation was observed, against two in September. That is what the source saw, not evidence that none took place.
Records by the million
Six claimed datasets held three million records or more each: two in Finance, one each in Healthcare, Manufacturing and Technology, and a national identity dataset in Government/Politics said to hold 850 million.
Finance recorded six incidents, five of them data breaches — customer databases from banks, lenders and an investment platform, posted or offered for sale. Healthcare’s four included a hospital whose servers were encrypted and patient records offered in bulk.
A breach claim on a forum is a claim, not a confirmation. Some prove smaller than advertised; some are old data resold. But a customer file does not need to be new to be expensive. The company it came from still has to answer for it.
The incident does not end with the claim
Two manufacturers named by a ransomware group in September had their data published on a forum in October, weeks after the claim. A defence dataset counted in September was offered again by a different seller. Each is counted once, in September — but each is a second event for the organisation it came from.
That is the cost a board misses. The ransom note is one day. The leak, the resale and the customers who find their details in it run for months, and they arrive at the company that collected the data — which may be a listed customer of the supplier that was hit.
Ransomware was quieter, and still on the supply side
Six of the 13 ransomware claims fell in Manufacturing, Business Services and Technology — down from fourteen of 21 in September. The other seven hit a distributor, a consumer-goods company, a property developer, a travel operator, a business school, a religious trust and a state police force.
Krybit was again the busiest group, with four claims. Orova listed three Indian companies within two days, which reads as one batch rather than three break-ins: a leak-site date is when a claim appeared, not when a network was entered.
What to do with this
List the suppliers that hold your customers’ personal data, and read what your contracts say about who pays when one of them leaks it. Then ask who would see it first if that data turned up for sale.
What was counted
- Ransomware 13
- Data Breach 33
- Underground Activity 7
- Malware And Hacking 1
- Vulnerabilities And Exploits 1
- Government/Politics12Ransomware 1, Data Breach 8, Underground Activity 3
- Finance6Data Breach 5, Underground Activity 1
- Technology6Ransomware 2, Data Breach 2, Malware And Hacking 1, Vulnerabilities And Exploits 1
- Business Services5Ransomware 2, Data Breach 2, Underground Activity 1
- Education5Ransomware 1, Data Breach 4
- Healthcare/Wellness4Data Breach 3, Underground Activity 1
- Manufacturing4Ransomware 2, Data Breach 2
- Consumer Goods3Ransomware 1, Data Breach 2
- Nonprofit/NGO3Ransomware 1, Data Breach 2
- Transportation2Data Breach 2
- Food Production1Data Breach 1
- Insurance1Underground Activity 1
- Real Estate1Ransomware 1
- Retail1Ransomware 1
- Tourism/Hospitality1Ransomware 1
The full grid for this window — all 23 verticals, the band thresholds and the machine-readable dataset — is in the October 2026 edition of the India Cyber Threat Scorecard, covering 1 October 2026 to 1 November 2026.