India

Cybersecurity in India: A Digital Powerhouse Confronting Massive Cyber Threats

India is one of the world's largest and most dynamic digital economies, with over 900 million internet users and a technology industry that serves as the backbone of global IT services. The country's rapid digital transformation, driven by initiatives like Digital India and the expansion of the Unified Payments Interface (UPI), has brought remarkable economic progress but has also created an enormous attack surface for cybercriminals. In 2024, India recorded over 369 million malware detections across 8.44 million endpoints, averaging approximately 702 detections per minute. India has achieved Tier-1 status in the International Telecommunication Union's Global Cybersecurity Index, reflecting significant national investment in cyber defense, but the scale of threats continues to grow alongside the country's digital footprint.

India's Cybersecurity Regulatory Framework

India has developed a multi-layered legal and regulatory framework to address cybercrime, data protection, and digital security.

The Information Technology Act, 2000 (IT Act): India's foundational cybersecurity legislation, the IT Act and its subsequent amendments establish the legal framework for electronic governance, digital signatures, cybercrime penalties, and data protection. The act criminalizes unauthorized access to computer systems, data theft, identity fraud, the spread of malicious code, cyber terrorism, and violations of privacy. Amendments added in 2008 strengthened provisions around data protection and introduced the concept of "reasonable security practices" that organizations must follow when handling sensitive personal data.

The Digital Personal Data Protection Act, 2023 (DPDPA): India's comprehensive data privacy law was officially enforced on November 13, 2025, with an 18-month compliance deadline for organizations. The DPDPA establishes strict requirements for personal data processing, including explicit consent requirements, purpose limitation, data minimization, and the right to erasure. The law imposes penalties of up to approximately $30 million (250 crore rupees) for significant violations. Notably, the DPDPA mandates stringent safeguards for AI training datasets, requiring explicit consent for data collection used in machine learning. The draft rules published in 2025 provide detailed implementation guidance on consent management, data breach notification (within 72 hours), cross-border data transfers, and the obligations of significant data fiduciaries.

CERT-In Directions (2022): The Indian Computer Emergency Response Team issued mandatory directions requiring organizations to report cybersecurity incidents within six hours of detection, maintain system logs for 180 days within Indian jurisdiction, synchronize ICT system clocks to the Network Time Protocol server of the National Informatics Centre or National Physical Laboratory, and designate a point of contact for CERT-In communications. These requirements, among the strictest incident reporting timelines in the world, apply to all service providers, intermediaries, data centers, and government organizations.

Sector-Specific Regulations: The Reserve Bank of India (RBI) has issued comprehensive cybersecurity guidelines for banks and financial institutions, including requirements for cyber security operations centers, incident response planning, and regular vulnerability assessments. The Securities and Exchange Board of India (SEBI) has published cybersecurity frameworks for stock exchanges, depositories, and registered intermediaries. The Insurance Regulatory and Development Authority of India (IRDAI) has similarly mandated cybersecurity standards for the insurance sector. The Telecom Regulatory Authority of India (TRAI) oversees security requirements for telecommunications infrastructure.

Key Cybersecurity Institutions

CERT-In (Indian Computer Emergency Response Team): Established in 2004 under the Ministry of Electronics and Information Technology, CERT-In operates as the national nodal agency for cybersecurity. In 2025, CERT-In handled over 2.944 million cyber incidents, issuing 1,530 alerts, 390 vulnerability notes, and 65 advisories. The agency coordinates incident response across government and critical sectors, provides early warning information, conducts forensic analysis of cyber incidents, and issues guidance on emerging threats. CERT-In also publishes advisories on AI-related threats, recommending measures to mitigate risks from AI-powered attacks including deepfakes, automated phishing, and AI-assisted social engineering.

National Critical Information Infrastructure Protection Centre (NCIIPC): Operating under the National Technical Research Organisation, NCIIPC is responsible for protecting India's critical information infrastructure in sectors including power and energy, banking and finance, telecommunications, transportation, government, and strategic and public enterprises. The agency conducts threat assessments, develops protective measures, and coordinates responses to threats against critical systems.

Indian Cyber Crime Coordination Centre (I4C): Established under the Ministry of Home Affairs, I4C coordinates efforts to combat cybercrime across India. The centre operates the National Cyber Crime Reporting Portal (cybercrime.gov.in), which allows citizens to report cybercrimes online, and a helpline (1930) for immediate assistance with financial fraud. I4C also provides training to law enforcement agencies, develops investigation tools, and coordinates with international agencies on cross-border cybercrime cases.

Major Cyber Threats Facing India

Phishing and Social Engineering at Scale: With hundreds of millions of new internet users coming online in recent years, many accessing the internet primarily through smartphones, phishing attacks in India are massive in scale. Attackers impersonate banks, UPI payment services, government agencies (including fake tax department and Aadhaar-related messages), and e-commerce platforms. Smishing (SMS phishing) is particularly prevalent, with fraudulent messages about KYC updates, account blocks, or prize winnings targeting users across all demographics. The multilingual nature of India's population means these attacks arrive in Hindi, English, Tamil, Telugu, Bengali, and numerous other languages.

Financial Fraud and UPI Scams: India's UPI system processed over 16 billion transactions per month by late 2025, making it the world's largest real-time payment platform. This massive transaction volume has attracted sophisticated fraud schemes including fake payment screenshots, QR code manipulation, impersonation of customer support agents, remote access scams where victims are tricked into installing screen-sharing apps, and loan app fraud where malicious lending applications harvest personal data for extortion.

Ransomware Targeting Critical Sectors: Indian healthcare systems, government agencies, educational institutions, and manufacturing firms face increasing ransomware attacks. The healthcare sector has been particularly affected, with attacks disrupting hospital operations and patient care. Government systems at both central and state levels have been targeted, and the manufacturing sector faces growing risks as industrial control systems become more connected. Small and medium enterprises, which often lack dedicated cybersecurity resources, are especially vulnerable.

State-Sponsored and Geopolitical Threats: India's geopolitical position makes it a target for state-sponsored cyber operations. Attacks on government networks surged dramatically during periods of heightened geopolitical tension, with over 1.5 million cyberattack attempts recorded during recent military operations. Critical infrastructure including defense systems, telecommunications networks, and power grids face persistent reconnaissance and intrusion attempts from advanced persistent threat (APT) groups attributed to various nation-states.

IoT and Infrastructure Vulnerabilities: India's Smart Cities Mission and the rapid deployment of IoT devices across cities, industries, and homes have created significant new attack vectors. Many IoT devices deployed in India lack adequate encryption and patching mechanisms, making them vulnerable to compromise. Botnet infections targeting IoT devices are particularly concerning, as compromised devices can be leveraged for distributed denial-of-service attacks, cryptocurrency mining, or as entry points into larger networks.

India as a Cybersecurity Talent Hub

India is simultaneously a major target for cyberattacks and one of the world's largest producers of cybersecurity talent. The country's vast IT services industry, which employs millions of technology professionals, has become a significant contributor to the global cybersecurity workforce. Indian cybersecurity professionals work at major technology companies worldwide, and India-based security operations centers provide round-the-clock monitoring services for organizations across the globe.

The Indian government and private sector have invested in cybersecurity education through programs at the Indian Institutes of Technology (IITs), the National Institute of Technology (NITs), and specialized cybersecurity training academies. National-level cybersecurity competitions and Capture the Flag (CTF) events help identify and develop emerging talent. However, India still faces a domestic cybersecurity skills gap, with demand for qualified professionals outpacing supply, particularly in specialized areas like cloud security, AI security, and industrial control system security.

Relevance for Southern California

India's cybersecurity landscape is directly relevant to residents and businesses in Orange County, Riverside County, and the broader Southern California region. The Indian-American community is one of the largest diaspora populations in Southern California, with strong personal and business connections to India. Many Southern California technology companies outsource IT services to Indian firms or employ Indian cybersecurity professionals. Understanding India's regulatory environment, including the DPDPA's data transfer requirements, is important for any business that processes personal data involving Indian citizens. Additionally, cyber threats that originate from or transit through South Asia can impact U.S. targets, making awareness of the regional threat landscape valuable for local cybersecurity preparedness.

Free Resources

• CERT-In Official Website - India's national cybersecurity incident response team, advisories, and alerts
• National Cyber Crime Reporting Portal - India's centralized platform for reporting cybercrime
• National Cyber Security Index - India - India's cybersecurity maturity rankings and indicators
• India Cybersecurity Regulations Guide - Comprehensive overview of India's cybersecurity regulatory landscape
• Carnegie Endowment: Mapping India's Cybersecurity Administration - In-depth analysis of India's cybersecurity governance structure
• CISA Shields Up - U.S. government guidance on international cyber threat awareness