The India Threat Scorecard
Observed cyber threat activity across 23 Indian industry verticals, counted and published on the first of every month.
Most threat reporting tells you what happened to somebody else, once, in prose. This is a count. The same 23 verticals, the same categories and the same rules every month, so that the figure for your sector this month means something against the figure for your sector last month.
No organisation is named here, in any edition. We publish counts — what was seen, in which vertical, in what volume. That is the part that is checkable, and it is the part worth citing.
The current scorecard
Baseline edition, covering 21 May 2026 to 21 August 2026. 27 counted incidents: Ransomware 16 · Underground Activity 5 · Data Breach 4 · APTs 1 · Hacktivism 1. 10 of the 23 verticals recorded no observed activity.
| Vertical | Incidents | Activity | Categories |
|---|---|---|---|
| Aerospace/Defense | 2 | Active | Underground Activity 1 · APTs 1 |
| Business Services | 5 | Elevated | Ransomware 5 |
| Consumer Goods | 0 | No activity observed | — |
| Credit Union | 0 | No activity observed | — |
| Education | 3 | Active | Ransomware 1 · Data Breach 2 |
| Energy/Resources | 1 | Watch | Hacktivism 1 |
| Engineering | 2 | Active | Ransomware 2 |
| Finance | 1 | Watch | Ransomware 1 |
| Food Production | 1 | Watch | Ransomware 1 |
| Government/Politics | 1 | Watch | Data Breach 1 |
| Healthcare/Wellness | 0 | No activity observed | — |
| Insurance | 0 | No activity observed | — |
| Legal | 0 | No activity observed | — |
| Manufacturing | 6 | Elevated | Ransomware 5 · Underground Activity 1 |
| Media/Entertainment | 0 | No activity observed | — |
| Nonprofit/NGO | 0 | No activity observed | — |
| Real Estate | 1 | Watch | Underground Activity 1 |
| Retail | 0 | No activity observed | — |
| Technology | 1 | Watch | Underground Activity 1 |
| Telecommunications | 2 | Active | Ransomware 1 · Underground Activity 1 |
| Tourism/Hospitality | 1 | Watch | Data Breach 1 |
| Transportation | 0 | No activity observed | — |
| Utilities | 0 | No activity observed | — |
How the bands are set. Elevated is 5 or more incidents in the quarter, Active is 2 to 4, Watch is one, and no activity observed is none. Nothing here is judged — the band follows from the count.
This is not a security rating. A band measures observed threat activity in a vertical over the period. It says nothing about the security posture, control maturity or risk of any organisation within that vertical.
10 of the 23 verticals recorded no observed activity in this window. That means none was seen, not that none occurred.
Every edition
- Baseline edition — 21 May 2026 to 21 August 2026, 27 counted incidents. Published 21 August 2026.
A new edition is published on the first of each month, covering the month before it. The machine-readable current edition is always at latest.json, and schema.json describes the shape, so a consumer can follow the series without scraping this page.
How this is compiled
Each edition counts publicly observable cyber threat activity affecting organisations in India, arranged across the same 23 industry verticals every time. An item is counted when the affected organisation is in India, or when the activity specifically targets India. Global vulnerability advisories, commodity malware listings and industry news are excluded from the counts.
Nothing is counted twice and nothing is weighted. A vertical’s figure is the number of distinct observations recorded against it in the window, and the band follows from that figure by a published rule. The window, the vertical list and the category list are held constant between editions, because a count series is worth nothing if what is being counted moves.
What we do not publish
No organisation is named, described or made identifiable, in any edition, in the page or in the dataset. We publish counts. This is a deliberate limit rather than an editorial preference: victim identities in threat reporting are frequently drawn from secondary sources and are frequently wrong, and we are not willing to put a name behind a claim we cannot verify.
Disclaimer
The India Threat Scorecard reports aggregate counts of publicly observable cyber threat activity affecting organisations in India, across 23 industry verticals.
- Informational only. Nothing here is legal, regulatory, financial or security advice. Reporting obligations turn on facts specific to an entity and an incident.
- No organisation is identified. We publish counts, not victims. Nothing here should be read as a statement about any identifiable organisation.
- Sources and method. Compiled and analysed by BitScore from its threat monitoring of Indian organisations, drawing on commercial cyber threat intelligence, dark-web and leak-site observation, and third-party news reporting. Some source material is processed using AI and large language model techniques. It may therefore contain inaccuracies, including in dates and in the attribution of activity.
- Observations, not confirmed breaches. An entry counts an observation — a claim made by a threat group, a marketplace listing, or a public report. It is not confirmation that a compromise occurred, nor of its scope.
- Not a security rating. The bands measure observed threat activity in a vertical over a period. They do not measure the security posture, control maturity or risk of any organisation in that vertical, and they are unrelated to any security rating.
- Coverage is a sample. What is observable is not everything that happened. A vertical showing no activity means none was observed in the period, not that none occurred.
- Corrections. If you believe something here is wrong, write to ni.ia.erocstib@ttimin and we will check it and correct the record.
- No liability. Provided “as is”. BitScore CyberTech LLP accepts no liability for any loss arising from reliance on it.
The published counts are free to reuse under CC BY 4.0 — use them, and credit bitscore.in.