Ransomware on Monday, an Aadhaar Spreadsheet on WhatsApp: Six Hours and Ninety Days
An institute's office runs 60 Windows machines, of which 34 still run Windows 7, with no patch cycle since 2021. One local administrator account with the password 'admin@123' is used on every PC, and Remote Desktop (port 3389) is forwarded from the internet router to the marks server so the accountant can work from home. Backups run nightly to a second partition of the same server disk. On Monday morning the office finds .locked files and a ransom note; the shared admission drive holding 4,000 application forms with names, phone numbers and Aadhaar numbers is encrypted. The marks server itself is still running. The same week it emerges that last month a staff member emailed an unencrypted spreadsheet of 3,200 applicants' Aadhaar and mobile numbers to an outside vendor, and the file has since been forwarded in a WhatsApp group. There is no incident response plan and the principal asks you, the computer instructor, what to do first.
1. Give the first six hours as an ordered list, with the reason each step sits where it does. Include your decision on whether to power off the machines.
Read the worked answer
- Remove the router's port-forward for 3389 and disable the RDP account before anything else. This is the probable entry point and it is the one action that is free, instant and stops re-entry while you work.
- Do not power off, but do isolate: unplug the office segment from the switch/uplink and disable Wi-Fi. The encryption of reachable shares is already finished; powering off loses volatile evidence (sessions, running processes) and gains little. The exception is a machine visibly still encrypting - yank that one's cable first, then keep it running for imaging.
- Preserve evidence before cleaning: photograph the ransom note, record the file extension and timestamps, export Windows Security logs (4624/4625) and the RDP source IPs.
- Find the account used: check the marks server's Security log for type-10 (RemoteInteractive) logons, and look for new local admin accounts, scheduled tasks and services. Assume the attacker has credentials.
- Verify the backup, not just its existence. The 'backup' is a second partition of the same disk - the attacker may have encrypted or reached it. Check before promising the principal a restore date.
- Rotate every credential - the shared admin@123 on 60 machines, the router, the RDP account, the vendor email - before restoring service. Restoring onto a network with live attacker credentials simply invites a second encryption.
Then rebuild, do not pay and do not attempt decryption tools on production data.
2. State the institute's legal exposure under the IT Act, 2000 and the Digital Personal Data Protection Act, 2023, distinguishing the ransomware event from the Aadhaar leak, and name the notifications owed.
Read the worked answer
Two incidents, two duties.
Ransomware: unauthorised access, damage and disruption fall under IT Act s.43 (civil liability, compensation) and s.66 (computer-related offences, up to 3 years and/or ₹5 lakh). If any stolen identity data is later used, s.66C (identity theft) is relevant. Separately, the CERT-In directions of 28 April 2022 require specified cyber incidents to be reported to CERT-In within six hours of noticing - the clock started Monday morning, not when the investigation closes.
Aadhaar spreadsheet: Aadhaar numbers are sensitive personal data. If the institute is a body corporate handling such data and failed to maintain reasonable security practices, s.43A of the IT Act exposes it to compensation to the affected persons. If the staff member held the data under a lawful contract and disclosed it, s.72A applies (up to 3 years and/or ₹5 lakh). Under the DPDP Act, 2023, the institute is a Data Fiduciary: it must give breach intimation to the Data Protection Board and to each affected Data Principal under s.8(6). The Schedule carries penalties up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to notify a breach.
Notifications owed: CERT-In (6 hours), the Data Protection Board, the 3,200 affected individuals in writing, and internally a written record of the incident. The 4,000 ransomware-affected applicants need notification too if their data was exfiltrated. Do not disclose Aadhaar numbers again in the notification itself.
3. Design the 90-day fix: five controls, each tied to a specific failure in the scenario, with how you would measure that it is working.
Read the worked answer
| Control | Failure it answers | Measure |
|---|---|---|
| Remove internet RDP; publish only a VPN with MFA, RDP listening on LAN only | 3389 forwarded to the marks server | Quarterly external port scan shows 3389 closed; VPN logon report reviewed weekly |
| LAPS-style unique local admin password per machine; clerks run as standard users | 'admin@123' on all 60 machines | Random audit of 10 machines shows 10 distinct passwords; zero accounts with the old password |
| Patch cycle with a written SLA; retire or isolate the 34 Windows 7 machines | No patching since 2021 | Monthly WSUS/patch report: 100% of supported machines at ≤30 days; Win7 count reduced to 0 or on a documented isolated VLAN |
| 3-2-1 backup: nightly to a separate NAS, weekly offline/immutable copy, quarterly restore drill | 'Backup' on a second partition of the same disk | Restore drill log with measured RTO under 24 hours; backup reachable only with a separate credential |
| Data handling rule for Aadhaar: no plain-text attachments, vendor agreements, encrypted archive with out-of-band password, retention limit | The spreadsheet emailed to a vendor and forwarded on WhatsApp | Monthly sample audit of outbound mail and shared drives; zero unencrypted Aadhaar files found |
Add a one-page incident response card with the CERT-In reporting address and the 6-hour clock, and a 30-minute staff briefing in week 2. Sequence matters: controls 1 and 6 first (they are free and stop re-entry), then the backup drill, then patching and LAPS, which need procurement and a maintenance window.