{
  "name": "India Threat Scorecard",
  "edition": "2026-08",
  "label": "Baseline edition",
  "headline": "One group claimed ten of India’s sixteen ransomware victims",
  "url": "https://www.bitscore.in/reports/india-threat-scorecard/2026-08",
  "publisher": "BitScore CyberTech LLP",
  "licence": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "BitScore India Threat Scorecard — bitscore.in",
  "window": {
    "start": "2026-05-21",
    "end": "2026-08-21",
    "cadence": "quarterly"
  },
  "datePublished": "2026-08-21",
  "dateModified": "2026-08-21",
  "bandThresholds": {
    "elevated": 5,
    "active": 2
  },
  "totals": {
    "countedIncidents": 27,
    "excludedItems": 6,
    "verticalsWithActivity": 13,
    "verticalsWithNoActivityObserved": 10
  },
  "verticals": [
    {
      "vertical": "Aerospace/Defense",
      "incidents": 2,
      "band": "active",
      "categories": {
        "APTs": 1,
        "Underground Activity": 1
      }
    },
    {
      "vertical": "Business Services",
      "incidents": 5,
      "band": "elevated",
      "categories": {
        "Ransomware": 5
      }
    },
    {
      "vertical": "Consumer Goods",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Credit Union",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Education",
      "incidents": 3,
      "band": "active",
      "categories": {
        "Data Breach": 2,
        "Ransomware": 1
      }
    },
    {
      "vertical": "Energy/Resources",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Hacktivism": 1
      }
    },
    {
      "vertical": "Engineering",
      "incidents": 2,
      "band": "active",
      "categories": {
        "Ransomware": 2
      }
    },
    {
      "vertical": "Finance",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Ransomware": 1
      }
    },
    {
      "vertical": "Food Production",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Ransomware": 1
      }
    },
    {
      "vertical": "Government/Politics",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Data Breach": 1
      }
    },
    {
      "vertical": "Healthcare/Wellness",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Insurance",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Legal",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Manufacturing",
      "incidents": 6,
      "band": "elevated",
      "categories": {
        "Ransomware": 5,
        "Underground Activity": 1
      }
    },
    {
      "vertical": "Media/Entertainment",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Nonprofit/NGO",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Real Estate",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Underground Activity": 1
      }
    },
    {
      "vertical": "Retail",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Technology",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Underground Activity": 1
      }
    },
    {
      "vertical": "Telecommunications",
      "incidents": 2,
      "band": "active",
      "categories": {
        "Ransomware": 1,
        "Underground Activity": 1
      }
    },
    {
      "vertical": "Tourism/Hospitality",
      "incidents": 1,
      "band": "watch",
      "categories": {
        "Data Breach": 1
      }
    },
    {
      "vertical": "Transportation",
      "incidents": 0,
      "band": "none",
      "categories": {}
    },
    {
      "vertical": "Utilities",
      "incidents": 0,
      "band": "none",
      "categories": {}
    }
  ],
  "ransomwareByGroup": [
    {
      "label": "One group",
      "incidents": 10
    },
    {
      "label": "Four other named groups, one each",
      "incidents": 4
    },
    {
      "label": "Group not stated",
      "incidents": 2
    }
  ],
  "notes": [
    "Aggregate counts only. No organisation is named, described or made identifiable in this dataset.",
    "A count is an observation, not a confirmed breach.",
    "A band measures observed threat activity in a vertical, not the security posture of any organisation in it.",
    "A vertical with no activity means none was observed in the window, not that none occurred."
  ]
}