Ransomware at a Listed NBFC: Disclosure and Ransom Decision

The incident triggers multiple reporting obligations. Under the CERT-In directions, cyber security incidents must be reported within six hours in the prescribed format; an oral notification is not sufficient. The company should file the written report and preserve logs and forensic evidence.

As a listed company, PayNidhi must assess the incident under SEBI LODR Regulation 30. A ransomware attack that encrypts KYC and credit files and disables the customer app is likely to be a material event, qualitatively if not quantitatively. Disclosure must be made promptly and generally within 24 hours of the material event. The CEO’s desire to avoid a run on deposits is not a legal basis to delay; delayed or misleading disclosure can itself be a violation.

As an NBFC, the company must report the incident to RBI under the applicable cyber security framework. Because personal data of borrowers is affected, the DPDP Act, 2023 requires notification to the Data Protection Board and to affected data principals, in the prescribed manner, without undue delay. The company should also notify its board, the IT strategy committee, insurers and law enforcement.

The compliance position is therefore: notify first, investigate in parallel, and avoid speculative statements. The company can state that service is affected, containment is underway and a forensic review has begun.

There is no general statutory prohibition on paying a ransom in India, but payment is not a compliant solution by itself. The board must consider:

• Sanctions and terrorism financing. The attacker or wallet may be linked to sanctioned persons; payment can create legal exposure. Screen the wallet and take legal advice.
• No guarantee. Payment may not restore data; attackers may re-extort. The 36-hour-old backup may allow recovery with less disruption.
• Ethics and public policy. Paying encourages ransomware and funds criminal activity. The board should prefer restoration from backup, containment and law-enforcement cooperation.
• Insurance and governance. The insurer and forensic advisers should be consulted. The decision, and the reasons, must be minuted; the board cannot delegate a reputational and legal decision to the CEO alone.
• Disclosure. A ransom payment does not avoid the need to notify CERT-In, RBI, SEBI or affected data principals.

The better course is a board-approved incident response: restore from backup, validate integrity, notify regulators, engage law enforcement and forensic experts, and communicate transparently. If payment is considered at all, it should be a last resort with legal and sanctions clearance.

The board should treat cyber risk as an enterprise risk, not only an IT issue. Recommendations:

• Approve a cyber risk appetite and a clear incident escalation matrix with named decision-makers and regulatory timelines.
• Make the IT strategy committee review cyber resilience quarterly, including backup restoration tests, not merely backup existence.
• Adopt a 3-2-1 backup architecture with immutable or offline copies and tested recovery objectives.
• Segment the loan-management server from payment gateways, enforce multi-factor authentication and least-privilege access.
• Maintain a data map for KYC and credit files, apply retention limits and conduct data protection impact assessments.
• Include cyber incident reporting in the disclosure policy and train the CS, CFO and CISO on Regulation 30 and CERT-In timelines.
• Require third-party risk assessments and contractual security clauses for vendors with access to customer data.
• Commission an internal audit or independent review of the incident and report the findings to the audit committee.

The board should also test the cyber crisis plan through a tabletop exercise and document lessons learned. Concealment should be explicitly prohibited; the goal is containment, regulatory compliance and customer protection.