Ransomware Attack Complaint Process Step by Step in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Court process

To file a ransomware attack complaint in India, give a written information at the police station with jurisdiction over the place where the attack was discovered or where its effects were felt, or lodge it on cybercrime.gov.in or by calling 1930. Ask for the acknowledgement and the FIR number before you leave. The offence is cognizable, so the police can register a First Information Report under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 without waiting for a magistrate's order.

What makes a ransomware complaint different from an ordinary theft complaint is that the loss is partly invisible. There is no stolen object to describe, and the damage is in locked files and a demand rather than in a missing item. A complaint that reads like a technical incident report tends to stall. A complaint that reads like a criminal allegation — who did what, when, how it was discovered, what it cost — moves. This page sets out the second kind.

What you are actually alleging

You are alleging unauthorised access to a computer resource and damage to it, which is covered by Sections 43 and 66 of the Information Technology Act, 2000. If credentials belonging to an employee or customer were used, Sections 66C and 66D may also apply. The demand for payment is a threat, and Section 351 of the Bharatiya Nyaya Sanhita, 2023 covers criminal intimidation. If the attacker has copied data out and threatens to publish it, that threat is part of the same allegation and should be described in the complaint in your own words.

Naming the sections is helpful but not mandatory. What the officer needs is a clear account: what system was affected, when the abnormality was first noticed, what the attacker did, what was demanded and how. Legal characterisation can be refined later, by the investigating officer or by your lawyer. A complaint that contains an accurate narrative and an incorrect section is easier to fix than one that contains the right section and no facts.

Documents to keep ready

Assemble these before you go, and carry two copies of everything. The list is not a formality; each item answers a question the officer will ask.

Where the affected system belongs to a company, carry a board resolution or a letter of authorisation naming the person who is complaining. An officer who is unsure whether the complainant has authority to speak for the company may treat the complaint as informal and delay registration.

Where to file, and what each forum does

For an attack on a business or a large system, the local police station may not be the best first stop. Many districts have a cyber crime cell, and the state cyber crime unit handles cases that cross districts. Filing at the station is still lawful and still creates a record; the officer may forward it. The practical advantage of filing at the station is speed and a physical acknowledgement. The practical advantage of filing online is a timestamped record that is hard to dispute later.

The complaint process, step by step

1. Write the complaint before you speak to anyone. Set out the facts in chronological order, with dates and times, and sign it.
2. Attach the demand and the logs. Provide copies, keep the originals, and note in the complaint that originals are retained.
3. File at the station or online. If you file online, also give a copy at the station so there is a local record.
4. Insist on the acknowledgement. Note the FIR number, the officer's name and the date. If registration is refused, ask for the reason in writing.
5. Give a Section 63 certificate for electronic records. Where you produce logs or copies, supply the certificate required under the Bharatiya Sakshya Adhiniyam, 2023 so the material is admissible.
6. Follow up in writing. A short written reminder every fortnight creates a record of diligence without becoming harassment.
7. If nothing moves, approach the magistrate. Under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita, 2023, a magistrate may direct investigation where the police fail to act.

What happens after registration

Once an FIR is registered, the investigating officer has the power to seek records from banks, platforms and service providers, and to send preservation requests that carry legal weight. An officer can also record the seizure of devices and arrange for a forensic examination, which gives the technical findings a formal status that a private report lacks.

The investigation will usually take longer than the complainant expects. Ransomware cases often cross state and national borders, and the trail may run through foreign infrastructure. Under Section 187 of the Bharatiya Nagarik Suraksha Sanhita, 2023, the officer reports the result of the investigation to the magistrate, and that report is the point at which the complainant can see whether the case has been treated as closed. If the report is a closure, the complainant has a right to be heard before the court accepts it.

If the police decline to register

Refusal happens, often because the officer does not see the incident as a cognizable offence or because the technical facts are unfamiliar. The remedy is not to argue at the counter. Ask for the refusal in writing, keep a copy, and then move to the magistrate with a complaint that sets out the facts and the sections. A magistrate who is satisfied that a cognizable offence is disclosed can direct investigation. Where the refusal is on the ground that the matter is civil, the complainant should explain why the demand and the unauthorised access make it criminal, not merely a commercial dispute.

Writing the facts in the order that helps

A useful complaint follows the sequence of the attack rather than the sequence of your discovery. Start with the system and who controlled it. Then describe the first abnormal event you can date: a mail that arrived, a login that came from an unfamiliar location, a file that changed unexpectedly. Then describe the escalation, in plain words, and finally the demand and the loss. End with what you have preserved and where.

Resist the urge to include every technical detail. An officer who cannot follow the narrative will stop reading, and a complaint that is three pages of jargon is easy to put at the bottom of the file. Use short sentences and one fact per sentence. If a technical term is unavoidable, add a plain-language gloss in brackets. The complaint will later be read by a magistrate who may not be technical, and by a defence lawyer who will look for gaps. Writing for that reader is the discipline.

Special considerations when the victim is a company

When a company is the victim, the complaint must establish both the company's identity and the authority of the person who signs it. The officer will want to see the registration, the authorisation and the connection between the affected system and the company's operations. It also helps to name the data that was affected, because the scale and sensitivity of the data shape the offence and the sentencing. A company should coordinate its criminal complaint with its insurance notification and, where applicable, its regulator's reporting requirement, so that the three records do not contradict each other.

Companies also face a reverse risk: an employee or an officer may be suspected of assisting the attack. The complaint should state the facts about access and control without accusing anyone prematurely. If an insider is suspected, that is a matter for the investigation, and a complaint that names an employee without evidence can expose the company to a defamation claim and can damage the investigation.

What the case will need at the trial stage

Long after the FIR is registered, the case will turn on whether the electronic records can be proved. The prosecution will need the original records, the Section 63 certificate from the Bharatiya Sakshya Adhiniyam, 2023, and a witness who can explain how the records were kept. Practically, that means the victim must be able to produce the person who exported the logs, the device if it still exists, and the policy that governed access. A victim who has replaced every laptop and rebuilt every server may still have the case, but proving it becomes harder and slower.

The complainant should therefore keep three things beyond the first weeks: a copy of the original electronic records, the Section 63 certificate, and a named contact who can testify to how the records were created and stored. These are the items that most often go missing between the complaint and the trial, and their absence is the most common reason a technically sound case fails on proof.

What decides whether the complaint goes anywhere

The first factor is specificity. A complaint that says "our server was hacked" gives the officer nothing to investigate. A complaint that says which server, which account, which date, which demand and which loss gives the officer a starting point. The second factor is preservation. If the logs still exist, the case can be investigated; if they have been deleted, the officer can do little. The third factor is the connection between the demand and a financial trail, because that is what allows the police to seek bank records.

The fourth factor is the complainant's own conduct. A victim who reports within days, keeps records and answers follow-up questions is treated as credible. A victim who reports months later, after rebuilding the systems, is treated as a person with a story rather than a case. Neither outcome is guaranteed, but the difference in how the complaint is handled is real.

Mistakes that weaken the complaint

• Describing the incident only in technical terms and omitting the demand and the loss.
• Filing online and not keeping the reference number.
• Handing over the only copy of the ransom note.
• Refusing to give a written complaint and relying on a verbal report.
• Waiting for the forensic report before filing, by which time the logs may be gone.

When to involve a lawyer

A ransomware complaint is a criminal process, but the drafting determines whether it is treated as one. A cyber crime lawyer in Kolkata can help you write the information so that the offence is clear, attach the right electronic-record certificate, and follow the file through the police station and the magistrate's court. If the police refuse to register, the same counsel can move the magistrate under the applicable provision. Where the attack has also caused a contractual or insurance dispute, you may need to look at civil litigation in parallel, because the criminal case will not recover your money.

A complaint is not a technical report. It is an allegation that a named offence was committed, by someone, at a time, causing a loss.

Bring the facts, the demand and the logs. The legal framing can be corrected; a lost log cannot.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Vishing call fraud complaint: documents and timeline
• Trading app scam complaint: process and documents
• Mutual fund scam complaint: process and timeline
• UPI Fraud Complaint Process in India: Steps and Timeline
• Stock market scam complaint: step by step process in India
• Sextortion Complaint: Step-by-Step Process and Documents

Cyber crime lawyer in your city · Bank account freeze help · Contact