Data breaches rose to 33 in India in October 2026

That moves the cost, not the size of it. Ransomware stops a supplier for a fortnight and shows up as a late delivery. A leaked customer file stays leaked, is sold again, and lands on whoever collected the data — the supplier, its processor or the listed company that hired them both.

The scorecard

Nine verticals sit in Elevated, as in September, led by Government/Politics on twelve, level with September, then Finance and Technology on six each. Eight recorded no observed activity — none was seen, which is not the same as none occurring. All 23 verticals were queried this month, so none is unmeasured. The window runs from 1 October, the day after the September edition closed, to 1 November, the day the source was pulled; no item is dated 1 November, so the series has no gap and no overlap. The source set held 100 listings: 55 are counted; 37 failed the India counting rule; and 8 repeated an item already counted, and are counted once — five elsewhere in this edition, and three in September, whose data was published or offered again in October. Seven items the source filed under a vertical that plainly did not fit are counted where they belong: three Credit Union listings concern two lenders and a software company, and are counted under Finance and Technology; government defence-research and foreign-affairs data filed under Aerospace/Defense, Education and Nonprofit/NGO is counted under Government/Politics; and a professional society filed under Government/Politics is counted under Nonprofit/NGO. September is the first comparable edition — monthly, from the same source, on the same rules — so the movements here are month on month. The baseline covered a quarter and was compiled differently, and is context, not the start of a trend.

What the month showed

• Data breaches led, and grew. Thirty-three data breaches, up from 26; thirteen ransomware claims, down from 21; seven underground listings, down from sixteen. Government/Politics carried eight of the breaches and Finance five.
• Six datasets ran to millions of records. Six claimed datasets held three million records or more each — two in Finance, one each in Healthcare, Manufacturing and Technology, and a national identity dataset in Government/Politics said to hold 850 million. A forum claim is not a confirmation, but a customer file does not need to be new to be expensive.
• September’s victims leaked in October. Two manufacturers listed by a ransomware group in September had their data published on a forum in October, and a defence dataset counted in September was offered again by a different seller. Each is counted once, in September. The claim is the start of an incident, not the end of it.
• Krybit was again the busiest group. Four ransomware claims, down from six, in Manufacturing, Real Estate, Technology and Nonprofit/NGO. Orova claimed three, all listed within two days; thegentlemen two; four other groups one each.
• Healthcare went from one incident to four. A hospital’s servers encrypted, patient records offered for sale, a pharmaceutical company’s data posted, and remote access into a diagnostics clinic offered at $200.
• Fewer access sales, still cheap. Seven underground listings, against sixteen in September. Access to a public social-security portal was offered at $2,700, and a central government website — database, admin panel and web shell — at $300.

What the month meant for a business, rather than what it counted, is in the blog: In October 2026, Indian ransomware fell and data leaks rose.

Why it reaches your numbers before it reaches the news

Six of the 13 ransomware claims fell in the supplier sectors — Manufacturing, Business Services and Technology — against fourteen of 21 in September. The supply-side exposure has not gone; it has moved into data. A supplier that leaks your customers’ records hands you the notification, the remediation and the complaint, and none of it shows in the supplier’s numbers.

A leak also outlasts the month it happens in. Data from September’s ransomware victims surfaced in October, and a file sold once is sold again. Each resale is another chance for a regulator, a journalist or a customer to find it — and the cost falls on the company that collected the data, which may never have had an incident of its own.

And the disclosure that follows

Five questions for the board

• Which suppliers hold your customers’ personal data? Thirty-three breaches this month, most of them personal data. Start with processors, collection agents and marketing vendors.
• Who pays if one of them leaks it? The DPDP Act’s security and breach-notice duties commence on 13 May 2027. The indemnities in this year’s contracts decide who carries the cost.
• Would you know if your data appeared on a forum? Two of September’s ransomware victims had their data published in October, weeks after the claim. Leaks are found by watching for them, not by waiting for the news.
• Which ten suppliers would stop your revenue within a fortnight? Ransomware fell, not to zero: thirteen claims, six of them in the sectors that make and run things for other companies.
• Can you show each supplier’s security as it stands today? An annual questionnaire predates every incident in this edition.

The numbers behind this edition

55 counted incidents across the month of 1 October 2026 to 1 November 2026, by category: Data Breach 33 · Ransomware 13 · Underground Activity 7 · Malware And Hacking 1 · Vulnerabilities And Exploits 1. A further 37 items in the source set were global advisories or industry news with no India nexus, and are excluded from every figure on this page.

Download this edition

Generated from the same source this page renders from, so the files and the grid cannot disagree. Aggregate counts only — there are no incident-level records in either file.

• india-threat-scorecard-2026-10.json — the edition, with per-vertical and per-category counts nested.
• india-threat-scorecard-2026-10.csv — one row per vertical, flattened for a spreadsheet.
• schema.json — JSON Schema for an edition, so you can validate against it rather than guess at the shape.

How this is compiled

Each edition counts publicly observable cyber threat activity affecting organisations in India, arranged across the same 23 industry verticals every time. An item is counted when the affected organisation is in India, or when the activity specifically targets India. Global vulnerability advisories, commodity malware listings and industry news are excluded from the counts.

Nothing is counted twice and nothing is weighted. A vertical’s figure is the number of distinct observations recorded against it in the window, and the band follows from that figure by a published rule. The window, the vertical list and the category list are held constant between editions, because a count series is worth nothing if what is being counted moves.

What we do not publish

No organisation is named, described or made identifiable, in any edition, in the page or in the dataset. We publish counts. This is a deliberate limit rather than an editorial preference: victim identities in threat reporting are frequently drawn from secondary sources and are frequently wrong, and we are not willing to put a name behind a claim we cannot verify.

Disclaimer

The India Cyber Threat Scorecard reports aggregate counts of publicly observable cyber threat activity affecting organisations in India, across 23 industry verticals.

• Informational only. Nothing here is legal, regulatory, financial or security advice. Reporting obligations turn on facts specific to an entity and an incident.
• No organisation is identified. We publish counts, not victims. Nothing here should be read as a statement about any identifiable organisation.
• Sources and method. Compiled and analysed by BitScore from its threat monitoring of Indian organisations, drawing on commercial cyber threat intelligence, dark-web and leak-site observation, and third-party news reporting. Some source material is processed using AI and large language model techniques. It may therefore contain inaccuracies, including in dates and in the attribution of activity.
• Observations, not confirmed breaches. An entry counts an observation — a claim made by a threat group, a marketplace listing, or a public report. It is not confirmation that a compromise occurred, nor of its scope.
• Not a security rating. The bands measure observed threat activity in a vertical over a period. They do not measure the security posture, control maturity or risk of any organisation in that vertical, and they are unrelated to any security rating.
• Coverage is a sample. What is observable is not everything that happened. A vertical showing no activity means none was observed in the period, not that none occurred.
• Corrections. If you believe something here is wrong, write to ni.ia.erocstib@ttimin and we will check it and correct the record.
• No liability. Provided “as is”. BitScore Cybertech LLP accepts no liability for any loss arising from reliance on it.

The published counts are free to reuse under CC BY 4.0 — use them, and credit bitscore.in.

This edition covers 1 October 2026 to 1 November 2026. Counts are of observations recorded in that window; an observation date is the date activity became visible, which is not the date it began.