DFIR Case Studies - India

When Cyber Incidents Hit Indian Organisations:
Real-World Digital Forensics & Incident Response

Three in-depth case studies - ransomware, data exfiltration, and Business Email Compromise - showing exactly how Indian enterprises across Mumbai, Delhi, Bangalore, Hyderabad, Chennai, Pune and beyond can contain, investigate and recover from today's most damaging cyber threats with ISECURION's DFIR expertise.

Ransomware Attack Data Breach / Exfiltration Business Email Compromise
Contents
01Why Indian Organisations Are in the Crosshairs
02Case Study: Ransomware at a Mumbai Logistics Firm
03Case Study: Data Breach at a Bangalore FinTech
04Case Study: BEC Fraud at a Delhi Law Firm
05The DFIR Framework Explained
06Sector-Specific Risks Across India
0712 Lessons Every Indian CISO Must Act On
08Choosing a DFIR Partner in India

Why Indian Organisations Are Now Prime Targets for Cyber Attacks

India is the world's fastest-growing major digital economy. With over 900 million internet users, the rapid digitalisation of banking, healthcare, logistics, legal services, manufacturing and government has created an attack surface that threat actors - both domestic and international - are actively and aggressively exploiting.

Between 2022 and 2024, India recorded a staggering rise in reported cyber incidents. Sectors previously considered outside the crosshairs - regional manufacturing firms in western India, mid-market legal partnerships in the capital region, specialist healthcare providers in southern metros - now find themselves targeted with the same sophisticated toolkits once reserved for global multinationals.

Digital Forensics Incident Response (DFIR) sits at the intersection of two disciplines: the forensic investigation that establishes what happened, how and who, and the incident response that contains the damage, ejects the attacker and restores business continuity. When these two functions are properly integrated - executed by experienced practitioners with the right tooling - organisations recover faster, suffer less financial damage, protect their regulatory standing and, critically, understand the root cause well enough to prevent recurrence.

Whether your organisation is headquartered in Mumbai, Delhi NCR, Bangalore, Hyderabad, Chennai, Pune, Kolkata, Ahmedabad, Jaipur or Kochi, the lessons embedded in these pages are directly applicable to your threat environment.

↑ 300%
Rise in ransomware incidents targeting Indian enterprises, 2021–2024
₹14 Cr+
Average cost of a data breach in India (IBM Cost of a Data Breach Report)
197
Average days to identify a breach without proactive monitoring
#3
India's global rank for number of cyber attacks received

The DPDP Act 2023 introduces mandatory breach notification with penalties reaching ₹250 crore. RBI, SEBI and IRDAI frameworks layer additional obligations. A well-executed DFIR engagement produces the documented evidence trail that protects leadership from personal liability and demonstrates regulatory good faith. ISECURION is a CERT-In empanelled firm specialising in DFIR across India.

Case Study 1: Ransomware Attack on a Mumbai-Based Logistics Firm

Operation "Locked Docks" - Ransomware Incident & Recovery
Ransomware
SectorThird-Party Logistics (3PL)
LocationMumbai, Maharashtra
Organisation Size~850 employees
Downtime11 Days (Critical Systems)
Ransom DemandedUSD 380,000

Background & Initial Discovery

A third-party logistics company operating warehouse and freight-forwarding operations across the Mumbai metropolitan region and surrounding distribution points arrived at their operations centre on a Monday morning to find their warehouse management system (WMS) unresponsive. Encrypted files had been spread across shared network drives with extensions characteristic of the LockBit ransomware family. A ransom note on every desktop demanded USD 380,000 in Bitcoin with a 72-hour deadline.

The organisation had cyber insurance but had not rehearsed their incident response plan. The first call went to their general IT support vendor - a managed services provider with no ransomware experience. Thirty-six hours were lost before a specialist DFIR team was engaged.

Attack Timeline Reconstruction

T-23 Days - Initial Access

Forensic analysis of firewall and VPN logs revealed a threat actor authenticating to the SSL VPN appliance using valid credentials belonging to a warehouse supervisor - harvested via credential-stuffing against a previously breached third-party service. The supervisor had reused a compromised password.

T-21 Days - Reconnaissance

Over two days the attacker mapped Active Directory structure, identified backup systems, and enumerated high-value shares. Windows event logs confirmed lateral movement using legitimate admin tools (LOLBins) to evade the organisation's basic antivirus.

T-19 Days - Privilege Escalation

An unpatched local privilege escalation vulnerability - a known CVE outstanding for seven months - was exploited to gain domain administrator credentials. From this position, the attacker had unrestricted access to the entire network.

T-5 Days - Data Exfiltration

DNS query logs recovered from an unencrypted firewall revealed large outbound transfers over five days to cloud storage hosted overseas. An estimated 120 GB of data was exfiltrated - client manifests, customs documentation, financials and employee PII.

T-0 - Detonation (03:17 IST, Sunday)

The ransomware payload was deployed simultaneously across 347 servers and workstations - deliberately timed to maximise dwell time before discovery and catch the organisation with minimal IT staff present.

Forensic Investigation Findings

The ISECURION DFIR team deployed within four hours of engagement, establishing a dedicated incident command structure and preserving forensic images before any remediation commenced. Key findings:

  • The compromised VPN account had no MFA enabled - giving the attacker uncontested access for 23 days.
  • The backup server was deliberately targeted and VSS snapshots deleted three days before detonation.
  • EDR was installed on only 60% of endpoints, leaving critical warehouse servers unmonitored.
  • No network segmentation existed between corporate IT and OT systems controlling warehouse automation.
  • The data exfiltration constituted a notifiable breach under DPDP Act 2023 and CERT-In mandatory 6-hour reporting obligations.

The attacker was in the environment for 23 days before detonating the payload. Every day of undetected dwell time is a day during which data is being stolen, backups are being destroyed and the cost of recovery is escalating silently.

- Lead Forensic Analyst, ISECURION DFIR Engagement

Response & Recovery Actions

Containment

Network segmentation enforced within 4 hours. Compromised accounts disabled. VPN access suspended. Firewall rules updated to block identified C2 infrastructure.

Evidence Preservation

Forensic images from 28 priority systems. Memory dumps from 6 live servers. Chain-of-custody documentation maintained for law enforcement and litigation.

Recovery Coordination

Clean restoration from offline cold backups. Priority given to WMS, ERP and customs systems. Manual workflows activated for freight operations during recovery.

Regulatory & Legal

CERT-In notified per mandatory 6-hour obligation. Cyber insurance claim initiated with forensic documentation. Affected clients notified with impact assessments.

Outcome & Business Impact

The ransom was not paid. Recovery was achieved through cold backups, vendor-supported rebuilds and manual data reconciliation. Total direct cost exceeded ₹9.2 crore - including DFIR fees, recovery labour, business interruption, legal costs, client notification and regulatory engagement. The reputational impact resulted in the loss of two major freight forwarding contracts. Post-incident investments in MFA, universal EDR, network segmentation, immutable backups and an IR plan - measures that would likely have prevented or rapidly contained the attack - were implemented under ISECURION guidance.

Case Study 2: Data Breach at a Bangalore FinTech Startup

Operation "Leaking Ledger" - Customer Data Exfiltration & Insider Threat
Data Breach
SectorFinTech / Digital Lending
LocationBangalore, Karnataka
Organisation Size~290 employees
Records Compromised2.4 Million Customer Records
Discovery MethodDark Web Intelligence Alert

Background & Discovery

A Bangalore-based digital lending platform regulated under RBI guidelines received an automated alert from their threat intelligence provider: a dataset containing what appeared to be their customer records - including Aadhaar-linked KYC data, mobile numbers, loan amounts and repayment histories - was being offered for sale on a dark web marketplace. Approximately 2.4 million records were listed as a fresh, verified extract from an Indian digital lending firm.

The organisation had not received any intrusion alert from their existing security stack. The breach had gone undetected internally. ISECURION was engaged within 24 hours of the intelligence alert.

Attack Vector & Investigation Approach

The investigation simultaneously pursued three hypotheses: external attacker, misconfigured cloud resource, or insider threat.

Phase 1
External Perimeter Review
Phase 2
Cloud Config Audit (AWS)
Phase 3 ✓
Insider Threat Analysis
Phase 4
Data Lineage Mapping
Phase 5
Evidence & Attribution

External perimeter testing found no evidence of successful intrusion. Cloud review revealed a misconfigured S3 bucket accessible for 18 days, but its data structure did not match the dark web dataset. The breakthrough came in Phase 3: database query logs enabled fortuitously for performance tuning revealed anomalous behaviour from a senior data analyst account.

Day 1–7 - Baseline Established

The analyst's normal query patterns - small, role-appropriate datasets for modelling - were reconstructed from 90 days of historical logs. No export activity to external systems during this period.

Day 31–61 - Anomalous Activity

37 large-volume queries executed between 22:00–02:00 IST on 19 separate nights. Each systematically extracted ~65,000 customer records in batches - consistent with deliberate staging to avoid volume-based alerts.

Day 62 - Exfiltration Route Identified

Cloud storage logs confirmed compressed files were uploaded from the analyst's workstation to a personal cloud storage account via a personal mobile hotspot - bypassing the corporate network and DLP monitoring entirely.

Day 68 - Dark Web Listing Identified

The threat intelligence alert triggered. The analyst had resigned three weeks prior, citing "personal reasons."

Evidence & Attribution

  • Investigation relied on database-side logging and endpoint activity correlation - the analyst used personal devices and a personal network for exfiltration.
  • The analyst's returned corporate laptop had not been encrypted, allowing forensic examination of artefacts - a rare fortunate circumstance.
  • Communications recovered from messaging app backups on the device showed the analyst discussing the data sale with an intermediary, establishing commercial motivation.
  • The evidence package was assessed as suitable for submission to the local Cyber Crime Police under the IT Act 2000 and applicable IPC provisions.

Regulatory Response & Consequences

RBI notification obligations for NBFCs were triggered immediately. UIDAI notification procedures were initiated given Aadhaar-linked data involvement. The DPDP Act 2023 breach notification requirements applied across the 2.4 million affected customers. The RBI issued a formal directive to conduct a comprehensive information security audit within 90 days. Civil and criminal proceedings against the former analyst were initiated.

2.4M
Records exfiltrated over 31 days of insider activity
₹0
DLP investment at time of breach - controls existed on paper only
31
Days of undetected insider activity before resignation
₹6.8Cr
Estimated total incident cost including regulatory response
Key Learning: Security controls designed for a founding team of 30 fail to scale as organisations grow to hundreds of employees with access to millions of customer records. Privilege creep, unchecked query access, and absent DLP enforcement are a data breach waiting to happen. ISECURION's DFIR retainer includes pre-incident access control reviews that catch these gaps before they become incidents.

Case Study 3: Business Email Compromise at a Delhi NCR Law Firm

Operation "Silk Thread" - BEC Financial Fraud & Email Forensics
Business Email Compromise
SectorLegal Services / Corporate Law
LocationDelhi NCR, Haryana
Organisation Size~75 staff (boutique firm)
Financial Loss₹2.3 Crore
Funds Recovered₹0.85 Crore (partial)

The Attack - A Study in Social Engineering Precision

Business Email Compromise is arguably the most financially destructive cyber threat facing Indian professional services firms today - and the most misunderstood. It does not require malware or sophisticated technical exploitation. It requires patience, research and the exploitation of human trust.

This Delhi NCR corporate law firm was managing a significant M&A transaction for a manufacturing client based in another Indian city. The transaction involved multiple tranches through escrow with frequent email communication across legal teams. Total transaction value exceeded ₹85 crore - making it an attractive OSINT-identified target.

Attack Chain Reconstruction

Week 1 - Account Compromise

Microsoft 365 audit logs revealed the managing partner's email account was compromised via a targeted phishing email replicating a Microsoft 365 login prompt. The attacker authenticated from an overseas VPN IP address. No MFA was enforced.

Weeks 1–4 - Silent Reconnaissance (Zero Emails Sent)

For four weeks the attacker silently read every email in the account - learning the transaction structure, payment schedule, participants' tone and language, and the internal wire transfer approval process. Not a single email was sent. The attacker was learning.

Week 5 - Lookalike Domain Registered

One week before the first major payment tranche, a domain visually identical to the law firm's domain was registered (replacing a lowercase 'l' with a '1' - imperceptible in most email clients). A partner-named account with identical display name and forged signature was created.

Week 6, Day 1 - Email Interception Infrastructure

Using access to the real account, the attacker created an inbox rule that silently forwarded all emails from the client's CFO to an external address and moved originals to a hidden folder - preventing the real partner from seeing communications while they corresponded from the spoofed domain.

Week 6, Day 4 - Fraudulent Wire Transfer (₹2.3 Crore Lost)

The attacker, posing as the managing partner, sent the CFO revised "escrow account details" citing a "banking compliance change." The email referenced specific transaction details only the compromised account could know. The CFO authorised a transfer of ₹2.3 crore - the account was emptied and mule-transferred within 90 minutes.

Digital Forensics Investigation by ISECURION

  • Full reconstruction of attacker activity within the M365 tenant using Microsoft Unified Audit Log analysis - establishing a precise timeline of unauthorised access, email reading, rule creation and account manipulation.
  • Email header analysis of fraudulent communications confirming origination from the lookalike domain.
  • OSINT analysis identifying how attackers identified the firm - a press release mentioning the transaction published three months earlier on the client's website.
  • Financial intelligence workstream with the local Cyber Crime Unit traced funds through mule accounts across multiple cities. Partial recovery of ₹85 lakhs was achieved through immediate banking freeze orders - the remainder was converted to cryptocurrency and transferred internationally before intervention.

The most dangerous aspect of this attack was the attacker's patience. Four weeks of silent observation - during which they could have been detected had monitoring been in place - allowed them to impersonate our client so convincingly that even experienced professionals were deceived.

- Senior Incident Responder, ISECURION BEC Investigation Lead

Preventive Controls Implemented Post-Incident

MFA enforced across all Microsoft 365 accounts
Conditional access policies restricting login to managed devices from approved geographies
DMARC, DKIM & SPF correctly configured to prevent domain spoofing
Out-of-band verification protocol for any wire transfer instruction received via email
Staff awareness training with quarterly simulated phishing exercises
M365 Defender alert tuning for impossible travel and new inbox rules

The DFIR Framework: How ISECURION's Incident Response Works in Practice

Across all three case studies, a consistent set of DFIR principles determined the quality of the outcome. ISECURION applies this structured six-phase methodology on every engagement.

1
Preparation

Documented and rehearsed Incident Response Plans, DFIR retainer relationships, and the technical logging infrastructure to support forensic investigation. ISECURION offers pre-incident readiness assessments and tabletop exercises.

2
Detection & Triage

As the Mumbai (23-day) and Bangalore (31-day) cases demonstrate, detection gaps are deadly. Effective detection requires SIEM correlation across endpoints, network, identity and cloud - not antivirus alone.

3
Containment

Stop the bleeding without destroying evidence. Network isolation, account suspension, credential rotation and C2 blocking - all executed while preserving forensic integrity. Wiping systems before imaging destroys the case.

4
Forensic Investigation

Forensic imaging, memory analysis, log correlation, malware reverse engineering and threat intelligence to answer the questions leadership, legal counsel, insurers and regulators all need answered.

5
Eradication & Recovery

Remove every attacker foothold - malware, persistence mechanisms, unauthorised accounts, modified configurations. Recovery sequencing is a business decision involving leadership, not just a technical one.

6
Post-Incident Activity

Forensic reports for legal, regulatory and insurance purposes; root cause analysis; remediation roadmap; and a lessons-learned review that improves your organisation's resilience against the next incident.

Sector-Specific DFIR Risks Across India's Major Cities

Cyber threats in India cluster around sectors and geographies that offer the highest reward-to-effort ratio for threat actors. ISECURION has DFIR experience across all major Indian verticals.

Financial Services

Mumbai, Pune, Hyderabad

Banks, NBFCs, insurance and brokerage firms face the highest regulatory consequences of a breach. Threats include BEC targeting large-value transactions, ransomware against core banking systems, and API-layer attacks. DFIR must account for mandatory RBI/SEBI notification timelines that compress the investigation window.

Technology & FinTech

Bangalore, Hyderabad, Pune, Chennai

Cloud misconfigurations, supply chain compromises targeting software companies, and insider threat from high-attrition engineering talent pools are the dominant risk vectors. The Bangalore case study above is representative of this risk profile.

Legal & Professional Services

Delhi NCR, Mumbai, Bangalore

Law firms, CAs and consultancies hold commercially sensitive client data and are intermediaries for high-value transactions - making them attractive for both BEC and espionage-motivated intrusions. The Delhi NCR case study illustrates the specific mechanics.

Healthcare

Hyderabad, Chennai, Mumbai, Delhi

Ransomware against healthcare infrastructure is particularly destructive because downtime directly affects patient care. Regulatory obligations under the DPDP Act 2023 for health data are among the most stringent in the framework.

Manufacturing & Logistics

Pune, Ahmedabad, Surat, Chennai, Kolkata

Legacy OT systems were never designed for internet connectivity but are increasingly networked for efficiency - creating attack paths that can disable physical production environments, as seen in the Mumbai logistics case study.

Government & PSUs

Delhi, State Capitals

High-prestige targets for nation-state and hacktivist threat actors. DFIR in this context operates under different legal constraints, often requiring coordination with CERT-In and national security agencies.

ISECURION DFIR Coverage Across India:

MumbaiDelhi NCRBangaloreHyderabadChennaiPuneKolkataAhmedabadJaipurKochiSuratNagpurChandigarhBhubaneswarIndoreVizag

12 Lessons Every Indian CISO and Business Leader Must Act On

Synthesising the three case studies and broader DFIR engagement patterns across India, twelve lessons apply with near-universal force.

1
MFA is non-negotiable.
Both the Mumbai VPN compromise and the Delhi M365 breach were made possible by absent MFA. Its absence in 2026 represents organisational negligence.
2
Attackers read your logs better than you do.
Logging without monitoring is a compliance checkbox, not a security control. SIEM correlation and SOC monitoring convert log data into real-time detection.
3
Backup architecture must assume attacker access.
The Mumbai ransomware attacker specifically targeted and destroyed backups before detonation. Immutable, air-gapped or offline backups are essential.
4
Dwell time is the enemy, not the breach event.
The destructive event in each case was the end of a chain that began weeks or months earlier. Reducing dwell time is the single most impactful lever for reducing incident cost.
5
Privilege is currency; treat it accordingly.
The Bangalore breach was enabled by excessive privilege. Least-privilege architecture limits blast radius for every type of compromise.
6
Wire transfer instructions require out-of-band verification.
No exception. No email-based payment instruction should ever be authorised without a pre-established phone confirmation. This single control defeats BEC.
7
Your suppliers are your attack surface.
Third-party vendors with network access must be subject to security assessment. Third-party risk management is a foundational control most Indian organisations haven't implemented.
8
Network segmentation is a force multiplier.
In the Mumbai case, absent IT/OT segmentation allowed a credential compromise to spread to warehouse automation. Segmentation is one of the most cost-effective resilience investments available.
9
Regulatory timelines will compress your response.
CERT-In's mandatory 6-hour reporting is among the most aggressive globally. Organisations not pre-designed around these timelines face simultaneous technical and regulatory crises.
10
Documentation is your legal protection.
DFIR reports with maintained chain-of-custody documentation are the difference between a successful insurance claim and a protracted dispute.
11
Tabletop exercises reveal gaps before attackers do.
Every organisation that has conducted a tabletop exercise discovers critical gaps in processes, communication chains and technical capabilities before a real incident forces them to.
12
Speed of engagement determines cost of recovery.
In the Mumbai case, 36 hours were lost before a specialist DFIR team was engaged. An ISECURION retainer guarantees response time and provides the pre-incident readiness work that makes investigations faster.

Choosing the Right DFIR Partner in India

The DFIR market in India ranges from global firms with local capability to boutique specialists with deep sector expertise. Selecting the right partner before an incident - not during one - is a strategic decision.

Technical Capability

Certified forensic practitioners (GCFE, GCFA, EnCE, CISM) with full-lifecycle capability - endpoint, memory, network, cloud, mobile forensics and malware analysis across AWS, Azure, GCP and M365.

Regulatory Familiarity

Deep familiarity with CERT-In reporting obligations, DPDP Act 2023, RBI cybersecurity frameworks, SEBI guidelines and sector-specific regulations. Regulatory mis-steps compound the damage.

Response Time & Coverage

An incident at 03:00 in Chennai cannot wait until Monday morning. Confirm 24/7 deployment capability - physical or remote - across your key locations.

Legal Admissibility

DFIR findings are used in regulatory proceedings, civil litigation and criminal complaints. Chain-of-custody documentation must make findings admissible in Indian legal proceedings.

Questions to Ask a Prospective DFIR Partner

The worst time to choose a DFIR partner is at 03:00 in the morning when your systems are encrypted and your leadership team is in a panic. The best time is today, before anything has happened - when you can assess the options rationally, negotiate appropriately and build the relationship that will define your response capability.

- Incident Response Director, ISECURION

The Cost Argument for Investment

Organisations consistently underestimate the total cost of a cyber incident. In the Mumbai logistics case, DFIR fees were approximately ₹70 lakhs - less than 8% of the ₹9.2 crore total incident cost. The investigation that cost ₹70 lakhs potentially avoided ₹8.5 crore in consequential costs from a less disciplined response.

For organisations across India - whether a growing FinTech in Bangalore, a legal partnership in Delhi NCR, a manufacturing conglomerate in Pune, or a healthcare group across southern India - the DFIR investment case is straightforward: proactive preparation and a trusted specialist partner cost a fraction of the incident you're trying to manage.

Why Choose ISECURION for DFIR in India

CERT-In Empanelled

Recognised by CERT-In as an empanelled cybersecurity auditing organisation - a credential that matters in every regulatory engagement.

24/7 Incident Response

Round-the-clock emergency response capability with guaranteed SLAs for retainer clients across all major Indian cities.

Regulatory & Legal Expertise

CERT-In reporting, DPDP Act 2023, RBI, SEBI and IRDAI - our team navigates India's regulatory landscape alongside your legal counsel.

Full-Spectrum DFIR

Endpoint, network, cloud, mobile forensics and malware analysis - supported by threat intelligence, insurance liaison and law enforcement coordination.

ISECURION DFIR capabilities include: Ransomware incident response · Data breach investigation · BEC forensics · VAPT services · Insider threat investigation · Cloud forensics (AWS, Azure, GCP) · M365 audit log analysis · CERT-In mandatory notification support · Cyber insurance claim documentation · Law enforcement liaison · DPDP Act compliance

Frequently Asked Questions: DFIR & Cyber Incident Response in India

Everything Indian organisations, CISOs and business leaders ask us about Digital Forensics Incident Response - answered by ISECURION's incident response practitioners.

Digital Forensics Incident Response (DFIR) combines two disciplines: digital forensics - the scientific investigation of what happened, how, and by whom during a cyber incident - and incident response - the structured process of containing, eradicating, and recovering from a cyber attack.

In India, DFIR matters critically because:

  • CERT-In mandates incident reporting within 6 hours of detection under its 2022 directions.
  • The DPDP Act 2023 requires mandatory breach notification with penalties reaching ₹250 crore.
  • Cyber insurance claims require forensically documented evidence to be valid.
  • Criminal prosecution of attackers and insider threat actors requires court-admissible digital evidence.
  • Board and regulatory accountability demands a documented, defensible account of the incident and the organisation's response.

Without qualified DFIR, organisations pay more, recover slower, face regulatory penalties and cannot effectively pursue legal remedies against attackers.

ISECURION's full-spectrum DFIR engagement covers:

24/7 emergency response (remote & on-site)
Forensic imaging & chain-of-custody evidence preservation
Endpoint, memory & network forensics
Cloud forensics (AWS, Azure, GCP, M365)
Malware reverse engineering
CERT-In mandatory notification support
DPDP Act breach notification assistance
Cyber insurance claim documentation
Law enforcement liaison
Forensic expert witness reports

ISECURION is a CERT-In empanelled cybersecurity auditing organisation, giving our incident reports additional regulatory standing.

ISECURION operates 24 hours a day, 7 days a week. Remote triage and containment guidance can begin within hours of initial contact. On-site deployment is available across Bangalore, Mumbai, Delhi NCR, Hyderabad, Chennai, Pune, Kolkata, Ahmedabad and other major Indian cities.

For organisations with an ISECURION DFIR retainer, guaranteed SLA response times are agreed contractually in advance - removing any ambiguity during an active crisis.

Critical reminder: Every hour of delay expands incident scope. In the Mumbai logistics case study, 36 hours lost before engaging a specialist team significantly increased recovery complexity and total cost.

Under CERT-In's 2022 directions (effective April 2022), all Indian organisations - service providers, intermediaries, data centres, corporates and government entities - must report cybersecurity incidents to CERT-In within 6 hours of detecting the incident or being made aware of it.

Reportable incident categories include: data breaches, ransomware attacks, unauthorised access, identity theft, phishing, DDoS attacks, website defacement, malicious code, and several others.

Additional requirements under the 2022 directions include: maintaining logs for 180 days in India, synchronising system clocks with NTP servers, and providing CERT-In with information, logs and assistance when required.

ISECURION manages CERT-In notification preparation and submission as part of every DFIR engagement, ensuring compliance even under the intense pressure of an active incident.

The Digital Personal Data Protection Act 2023 (DPDP Act) requires data fiduciaries - organisations that collect and process personal data - to notify the Data Protection Board of India and affected data principals (individuals) in the event of a personal data breach, without undue delay. Penalties for non-compliance can reach ₹250 crore.

Key DPDP breach obligations:

  • Notify the Data Protection Board of every personal data breach
  • Notify affected data principals whose data was compromised
  • Maintain a record of breaches and actions taken

The Bangalore FinTech case study - involving 2.4 million Aadhaar-linked customer records - triggered DPDP Act notification obligations alongside RBI mandatory reporting. ISECURION helps organisations understand their specific obligations, prepare notifications, and document incidents in a manner demonstrating regulatory good faith.

Note: Special categories of data - including health data and financial data - attract the most stringent DPDP Act obligations.

ISECURION's position - consistent with CERT-In, Interpol, NCSC UK and international law enforcement guidance - is that paying ransoms is not recommended. Key reasons:

  • No guarantee of decryption: Threat actors frequently fail to provide working decryption keys, or the decryption process is slow and incomplete.
  • Data still sold: Exfiltrated data is typically sold on dark web markets regardless of ransom payment. Payment does not prevent this.
  • Funds criminal operations: Ransom payments directly fund the same threat actor infrastructure used for further attacks.
  • Sanctions risk: If the ransomware group is on a sanctioned entity list (OFAC, EU), payment may constitute a sanctions violation.
  • Increases recurrence risk: Organisations known to have paid ransoms become repeat targets.

In the Mumbai logistics case study, the ransom was not paid. Recovery was achieved through cold backups, vendor-supported rebuilds and manual data reconciliation. A well-prepared organisation with immutable backups, tested recovery plans and a DFIR retainer substantially reduces both the pressure to pay and the cost of recovery.

During a DFIR investigation, ISECURION forensic analysts preserve:

  • Forensic disk images - bit-for-bit captures including deleted files and unallocated space, created using write-blocking hardware
  • Memory dumps - volatile RAM captures from live systems containing running processes, network connections and encryption keys
  • Network and firewall logs - traffic metadata, DNS query logs, proxy logs and IDS/IPS alerts
  • Windows event logs - Security, System, Application, PowerShell, Task Scheduler logs
  • Active Directory logs - authentication events, group membership changes, GPO modifications
  • Cloud audit logs - AWS CloudTrail, Azure Monitor, GCP Audit Logs, M365 Unified Audit Log
  • Email headers and server logs - for BEC and phishing investigations
  • EDR telemetry - process trees, file creation events, network connections

Chain of custody - a documented record of who collected each piece of evidence, when, how and where it has been stored - is essential for admissibility in Indian courts, regulatory proceedings (CERT-In, RBI, Data Protection Board), and law enforcement submissions. ISECURION maintains rigorous chain-of-custody documentation on every engagement.

Business Email Compromise (BEC) is a financially motivated attack where threat actors compromise or impersonate legitimate email accounts - typically senior executives, legal intermediaries or financial officers - to redirect high-value wire transfers or extract sensitive information. It requires no malware: only patience, research and the exploitation of human trust.

Typical BEC attack stages: OSINT target identification → phishing or credential stuffing to compromise an executive email account → weeks of silent surveillance reading emails → lookalike domain registration → interception of payment-related communications → fraudulent wire transfer instruction.

Protection measures for Indian organisations:

  • Enforce MFA on all email accounts (M365, Google Workspace) - this single control prevents the majority of account compromise
  • Configure DMARC, DKIM and SPF email authentication to prevent domain spoofing
  • Establish a mandatory out-of-band (telephone) verification protocol for all wire transfer instructions, regardless of apparent sender or urgency
  • Monitor M365 Unified Audit Logs for impossible travel, new inbox forwarding rules and suspicious OAuth app grants
  • Implement conditional access policies restricting email login to managed, compliant devices from approved geographies
  • Conduct regular phishing simulation training for all staff, particularly those in finance, legal and executive support roles

The Delhi NCR law firm case study in this article illustrates how a 4-week silent reconnaissance preceded a ₹2.3 crore fraudulent transfer - all without a single piece of malware being deployed.

Dwell time is the period between a threat actor's initial access to a network and the detection of their presence. Research consistently shows that longer dwell times correlate directly with higher incident costs - because attackers use undetected time to steal data, destroy backups, escalate privileges and maximise the blast radius of their eventual payload.

In the Mumbai ransomware case study, dwell time was 23 days. During this period, the attacker: mapped Active Directory, escalated to domain admin, deleted all backup snapshots and exfiltrated 120 GB of data - before deploying the ransomware payload at 03:17 IST on a Sunday morning.

Reducing dwell time requires:

  • MFA to prevent credential-based initial access
  • Universal EDR deployment across all endpoints and servers
  • SIEM-based log correlation and anomaly detection
  • Network segmentation to limit lateral movement
  • 24/7 SOC monitoring or a managed detection and response (MDR) service
  • Proactive threat hunting - actively searching for attacker presence rather than waiting for alerts

ISECURION's DFIR retainer includes proactive threat hunting engagements specifically designed to reduce dwell time between incidents.

An insider threat originates from within the organisation - a current or former employee, contractor or partner who misuses legitimate access to cause harm. Insider threats are among the hardest to detect because the actor uses authorised credentials and their activities initially appear legitimate.

The Bangalore FinTech case study illustrates a malicious insider: a senior data analyst who systematically exfiltrated 2.4 million customer records over 31 days through their legitimate database access - exporting through a personal mobile hotspot to evade corporate DLP monitoring entirely.

Forensic investigation techniques for insider threats:

  • Database query log analysis - reconstructing who queried what, when and how much
  • User Behaviour Analytics (UBA) - identifying anomalous patterns against historical baselines
  • Endpoint activity correlation - USB usage, print logs, cloud upload activity, application usage timelines
  • Cloud storage access logs - personal cloud service upload/download records
  • Network traffic metadata - volume anomalies, unusual destination analysis
  • Device forensics - recovering artefacts from corporate laptops (browser history, recently accessed files, connected devices)
  • Communication forensics - messaging app and email analysis where legally permissible on corporate devices

ISECURION prepares admissible forensic evidence packages for submission to Cyber Crime Police Stations and civil courts under the IT Act 2000, IPC provisions and DPDP Act 2023.

Cyber insurance claims in India require detailed forensic documentation of the incident, its root cause, scope, business impact and remediation actions. Insurers frequently dispute claims lacking adequate technical documentation - or where the organisation cannot demonstrate reasonable security controls were in place pre-incident.

ISECURION produces insurer-grade forensic investigation reports specifically structured to meet the evidentiary requirements of cyber insurers. Our documentation covers:

  • Complete attack timeline and root cause analysis
  • Full inventory of affected systems and compromised data
  • Containment and recovery actions taken with timestamps
  • Regulatory notifications made (CERT-In, DPDP, RBI/SEBI)
  • Evidence of pre-incident security controls
  • Quantified business impact assessment
  • Remediation roadmap demonstrating future risk reduction

In the Mumbai logistics case study, ISECURION's forensic report supported the cyber insurance claim, recovering a significant portion of the ₹9.2 crore total incident cost. We recommend notifying your insurer immediately upon detecting a potential incident and engaging ISECURION before taking any recovery actions that could compromise the forensic record.

A DFIR retainer is a pre-negotiated agreement with a specialist incident response firm - like ISECURION - that guarantees defined response time SLAs, pre-agreed commercial rates, and access to proactive pre-incident readiness services.

Retainer benefits for Indian organisations:

  • Guaranteed response SLAs - critical given CERT-In's 6-hour notification window and the time-sensitivity of ransomware containment
  • Pre-agreed commercial rates - ad-hoc emergency engagements during active incidents cost 2–4× retainer rates
  • IR plan review - ISECURION reviews and stress-tests your incident response plan before you need it
  • Tabletop exercise facilitation - rehearsing your team's response to realistic attack scenarios
  • Forensic logging prerequisites - ensuring the logging infrastructure needed for forensic investigation is in place before an incident occurs
  • Proactive threat hunting - actively searching for attacker presence between incidents
  • Priority deployment - retainer clients receive priority during major incidents when DFIR capacity is under simultaneous pressure

For any Indian organisation with material cyber risk - particularly in regulated sectors (banking, FinTech, healthcare, legal) - a DFIR retainer is the single most commercially rational security investment available.

Based on ISECURION's DFIR engagement patterns and published threat intelligence, the highest-risk sectors in India include:

SectorPrimary CitiesKey Threat Vectors
Financial ServicesMumbai, Pune, HyderabadBEC, ransomware on core banking, API attacks, regulatory-urgency pressure to pay
Technology & FinTechBangalore, Hyderabad, Pune, ChennaiCloud misconfigurations, supply chain compromise, insider threat, SaaS breaches
Legal & Professional ServicesDelhi NCR, Mumbai, BangaloreBEC targeting M&A transactions, espionage-motivated intrusions, client fund theft
HealthcareHyderabad, Chennai, Mumbai, DelhiRansomware (patient safety urgency), PHI exfiltration, pharma IP theft
Manufacturing & LogisticsPune, Ahmedabad, Chennai, KolkataOT/IT convergence attacks, supply chain ransomware, operational disruption
Government & PSUsDelhi, State CapitalsNation-state espionage, hacktivist DDoS, data exfiltration

ISECURION has active DFIR capabilities across all these sectors and cities.

VAPT (Proactive)
  • Planned and scheduled in advance
  • Simulates an attacker to find vulnerabilities before they are exploited
  • Produces a report of findings and remediation recommendations
  • Conducted against live systems with defined scope and rules of engagement
  • Goal: reduce attack surface and prevent incidents
DFIR (Reactive)
  • Triggered by an actual security incident
  • Investigates what a real attacker actually did
  • Produces forensic evidence for legal, regulatory and insurance purposes
  • Operates on potentially compromised live systems under emergency conditions
  • Goal: contain damage, eject attacker, recover, establish facts

Both are essential: VAPT reduces the likelihood of a successful attack. DFIR limits the damage when an attack succeeds. ISECURION provides both - and DFIR retainer clients often receive proactive VAPT services as part of their overall engagement.

Admissibility in Indian legal proceedings - whether before Cyber Crime Police Stations, IT Appellate Tribunals, High Courts or regulatory bodies - requires adherence to established forensic principles throughout the investigation.

ISECURION's evidence integrity protocol:

  • Write-blocking hardware is used for all forensic disk imaging, ensuring no modification to original evidence
  • Cryptographic hash values (MD5 and SHA-256) are generated and recorded for all forensic images at acquisition - any subsequent modification would produce a different hash, proving tampering
  • Chain-of-custody documentation records every person who handled each piece of evidence, the time and circumstances of handling, and where evidence was stored
  • Analysis on forensic copies only - original evidence media is never used for analysis
  • Tool validation - forensic tools used (FTK, Magnet AXIOM, Volatility, Wireshark) are industry-standard and their methodology is documented to withstand expert challenge
  • Contemporaneous notes - analysts record their observations and methodology in real time, not retrospectively

ISECURION's forensic reports are structured to meet the admissibility requirements of the Indian Evidence Act (specifically Section 65B for electronic records), proceedings before the Data Protection Board of India, and regulatory submissions to RBI, SEBI, IRDAI and other sector regulators. Our certified forensic examiners are available as expert witnesses in civil and criminal proceedings.

Have a question not answered here? Contact ISECURION's DFIR team at info@isecurion.com or submit an enquiry - we respond to all pre-incident queries within one business day.

Facing a Cyber Incident Right Now, or Want to Be Ready Before One Hits?

ISECURION DFIR - Serving Mumbai, Delhi NCR, Bangalore, Hyderabad, Chennai, Pune & Pan-India

Our DFIR team provides emergency incident response and proactive retainer services. Whether you need us at 03:00 today or want to build your resilience before an attacker does, we are ready.

Request Incident Response Consultation Explore VAPT Services

This article is produced for informational and educational purposes. Case study details are representative composites based on patterns observed across real DFIR engagements in the Indian market. Consult qualified legal counsel and DFIR specialists for advice specific to your situation.

WhatsApp