India now stands at the center of a global storm of digital aggression, absorbing nearly one in eight hacktivist attacks worldwide while its financial losses from cybercrime have multiplied nearly threefold in just three years. From state-sponsored malware campaigns that darkened Mumbai's power grid to espionage operations targeting government systems, the threats are neither random nor abstract — they are deliberate, escalating, and aimed at the foundations of a modernizing nation. The deeper question India faces is not merely one of security budgets or technical defenses, but whether its ins
India's cyberattack costs surge 295%, exposing critical infrastructure gaps
Malware surged from 5 million to 53 million instances in three years
Mark
So India went from being one target among many to the primary target for hacktivist attacks globally. What changed?
Mimi
The report doesn't specify a single turning point, but the numbers suggest India's digital economy expanded rapidly while its defenses didn't keep pace. The country has hundreds of millions of internet users, growing digital infrastructure, and increasingly valuable data.
Luke
Right, but we should be careful here. The report says India accounted for 12.8 percent of global hacktivist incidents in 2024. That's the largest share, but it's not overwhelming—Israel was second at 7 percent. We don't know if that's because India is uniquely vulnerable or because it's a larger, more attractive target by sheer size.
Mark
The financial losses are staggering though—₹12,181 crore in 2024 versus ₹551 crore in 2021. That's not just more attacks; that's more damaging attacks.
Mimi
Exactly. And the malware detections tell part of that story. Fifty-three million instances in 2024 compared to 5 million in 2021. Healthcare and banking were hit hardest, which makes sense—those sectors hold sensitive personal and financial data.
Luke
But here's what I'd want to know: are those 53 million detections 53 million separate attacks, or are they instances of the same malware being detected repeatedly? The report doesn't clarify. And when it says healthcare accounted for 21 percent of malware cases, is that 21 percent of all detections, or 21 percent of breaches that caused actual damage?
Mark
The state-sponsored attacks seem like the real danger. Red Echo taking down power in Mumbai, Transparent Tribe going after government systems.
Mimi
Those are documented incidents, yes. But they're also relatively rare in the overall picture. The report mentions them as examples of expanding threats, not as the primary driver of the 295 percent increase in losses.
Luke
And that's important to note. We have two confirmed state-sponsored operations mentioned—one in 2020, one in 2025. That's not nothing, but it's also not the whole story. Most of the financial damage is probably coming from cybercrime and fraud, not geopolitical cyberwarfare.
Mark
So what's actually broken in India's defenses?
Mimi
The regulatory framework. Industrial control systems managing power, transport, and energy aren't adequately protected. That's the gap experts keep pointing to.
Luke
Though I'd note that assessment comes from a 2021 article. The report is from 2025. We don't know if anything has changed in the regulatory environment since then. The article doesn't say whether new protections have been put in place.
Le Pouls
- India's cybercrime losses exploded from ₹551 crore in 2021 to ₹12,181 crore in 2024 — a 295% surge that signals a crisis no longer measured in isolated incidents but in systemic financial hemorrhage.
- Malware detections leapt tenfold in three years, with healthcare and banking — the sectors people trust most with their lives and livelihoods — absorbing 40% of all malicious activity.
- State-sponsored actors from neighboring rivals have already demonstrated their reach: a Chinese-linked group caused a two-hour Mumbai blackout in 2020, while a Pakistani-linked group targeted Indian government systems as recently as 2025.
- Industrial control systems governing power grids, transport, and energy remain dangerously under-protected, with regulatory frameworks that experts say have not kept pace with the sophistication or frequency of attacks.
- Cybercrime complaints per million internet users surged nearly fiftyfold between 2019 and 2024, revealing not just growing threats but a population increasingly exposed and a state still searching for adequate answers.
India now stands at the center of a global storm of digital aggression, absorbing nearly one in eight hacktivist attacks worldwide while its financial losses from cybercrime have multiplied nearly threefold in just three years. From state-sponsored malware campaigns that darkened Mumbai's power grid to espionage operations targeting government systems, the threats are neither random nor abstract — they are deliberate, escalating, and aimed at the foundations of a modernizing nation. The deeper question India faces is not merely one of security budgets or technical defenses, but whether its institutions can evolve fast enough to protect the digital infrastructure upon which its future increasingly depends.
India has emerged as the world's foremost target for hacktivist attacks, absorbing nearly one in eight such incidents globally in 2024. Over the five years from 2019 to 2024, the country recorded 7.9 million cybersecurity incidents and 5.3 million cybercrime complaints — and the financial toll has been staggering. Losses from cyber fraud grew from ₹551 crore in 2021 to ₹12,181 crore by 2024, a 295 percent increase that reflects not just more attacks, but far more damaging ones.
The human scale of the crisis is equally striking. Cybersecurity incidents per million internet users more than tripled over the period, while cybercrime complaints per million users surged nearly fiftyfold. Prime Minister Modi named cybersecurity a national security priority in early 2022, but the threat has only deepened since.
The attacks are not opportunistic — they are strategic. In 2020, a malware campaign attributed to Red Echo, a suspected Chinese state-sponsored group, triggered a two-hour power outage in Mumbai, exposing the fragility of India's critical infrastructure. More recently, an alleged Pakistani group targeted Indian government systems using malicious files engineered to compromise multiple operating platforms. These incidents point to a sustained, coordinated campaign of cyberespionage against India's most sensitive institutions.
Malware detections tell their own story: from 5 million instances in 2021 to 53 million in 2024, a tenfold rise in three years. Healthcare and banking together account for 40 percent of all malicious detections — sectors where disruption carries consequences far beyond financial loss.
At the heart of the vulnerability lies a regulatory gap. Industrial control systems managing power grids, transport networks, and energy infrastructure are prime targets, yet India's legal and policy frameworks have not evolved to match the threat. Experts have warned that without urgent intervention, the very systems that sustain modern Indian life remain exposed to adversaries who have already proven their willingness — and ability — to strike.
India has become the world's primary target for hacktivist attacks, accounting for nearly one in eight global incidents in 2024. Between 2019 and 2024, the country recorded 7.9 million cybersecurity incidents and filed 5.3 million cybercrime complaints, according to Group-IB's Tech Crime Trends Report. What makes this surge particularly alarming is not just the volume but the velocity of financial damage. Cyber frauds that cost ₹551 crore in 2021 had ballooned to ₹12,181 crore by 2024—a 295 percent increase in three years.
The scale of the problem becomes clearer when measured per capita. Between 2019 and 2024, cybersecurity incidents per million internet users jumped from 687 to 2,304, more than tripling in five years. Cybercrime complaints per million users surged even more dramatically, from 45 to 2,295—a nearly fiftyfold spike, according to data from the Asia Pacific Computer Emergency Response Team. Prime Minister Narendra Modi identified cybersecurity as a priority national security concern in February 2022. The threat has only intensified since.
While India's share of global data breach costs remains modest compared to the United States or United Kingdom—rising from 3.19 percent in 2019 to 3.77 percent in 2025—the trajectory is unmistakable. The absolute financial burden is expanding year after year, signaling that India's digital economy is increasingly exposed to sophisticated criminal and state-sponsored operations.
The attacks are not random. In October 2020, security analysts attributed a malware campaign to Red Echo, a suspected Chinese state-sponsored group, that caused a two-hour power outage in Mumbai. The incident exposed how vulnerable India's critical infrastructure had become. More recently, in August 2025, Transparent Tribe, an alleged Pakistani group, targeted Indian government entities using malicious files designed to compromise both Windows and Linux systems. These operations suggest a coordinated expansion of cyberespionage threats against India's most sensitive institutions.
Malware itself has become exponentially more prevalent. Detections surged from 5 million instances in 2021 to 53 million in 2024, a tenfold increase in just three years, according to the India Cyber Threat Report 2025, released by the Data Security Council of India and Seqrite. The sectors under heaviest assault are those that keep the economy running. Healthcare accounted for 21 percent of malware cases, followed by banking and financial services at 19 percent, hospitality at 17 percent, education at 15 percent, and small and medium enterprises at 7 percent. Together, healthcare and banking alone represent 40 percent of all malicious detections.
The vulnerability lies partly in the systems that manage essential services. Industrial control systems—the hardware and software that operate power grids, transportation networks, and energy infrastructure—are prime targets for cyberattacks. Yet India's existing regulatory framework has not kept pace with the threat. Writing in the Economic and Political Weekly in September 2021, Balraj K Sidhu and Arunender Singh argued that the government and private sector have failed to implement strong measures to secure these systems. As power, transport, and energy networks become increasingly digitized and interconnected, they grow more vulnerable to attack. The regulatory gap remains unresolved, leaving critical infrastructure exposed to the very threats that have already demonstrated their capacity to disrupt essential services.
Citations marquantes
Critical information infrastructure relying on industrial control systems are prime targets of cyberattacks, and India's existing regulatory framework has not yet taken strong measures to strengthen ICS security.— Balraj K Sidhu and Arunender Singh, Economic and Political Weekly (2021)
Envie de l'histoire complète ?
Lire l'original sur Business Standard ↗
Politics & Governance