The ransom note is written to be read by a frightened person at the worst moment of their year. This page exists so the decision is made by the calm version of you: why payment fails even on its own terms, and where an attack in India actually gets reported.
Every ransomware note makes the same offer: pay, and get your files back. It sounds like a transaction. It is not one - it is a negotiation with the people who just attacked you, conducted under a countdown timer they invented. Governments and incident responders across the world give the same advice, and this guide repeats it with the reasoning, because the reasoning matters more than the rule: do not pay. Then it covers the constructive half - the reporting routes that exist in India, because reporting is the action that actually improves your position and everyone else's.
None of this is moralising. It is the arithmetic of the decision, and it is why the offline backup - the copy that makes the whole offer irrelevant - gets its own guide in this set.
Report promptly, even if you recover fully from backups. Reports are how authorities track campaigns, warn other targets and sometimes release recovery help.
cybercrime.gov.in: file the complaint online and save the acknowledgement. The national helpline 1930 is the fastest route when money has moved or is moving.cert-in.org.in: India's national incident response agency. Organisations in particular are expected to report incidents to CERT-In, and its advisories are the authoritative local source during big campaigns.Details and forms change over time, so always confirm the current process on the official sites themselves rather than through search-result summaries.
The photographs of the ransom note and screens you took in the first five minutes, the time you noticed the attack, which machines and shared folders were involved, and anything you were asked to pay (amount and any wallet or contact details shown in the note - record them, never use them). If your office has IT support, their timeline joins yours. Small details that feel trivial at the time - the attachment name, the sender address - are often the thread an investigator pulls first.
The endgame this guide set has been building toward: rebuild or clean the machine, restore from the offline backup copy, change important passwords from a known-clean device (attackers who steal data often steal credentials too), and turn on the layers that were off - Controlled Folder Access, Tamper Protection, cloud protection - before reconnecting to shared folders. An attack survived with backups and reported properly is a genuinely bad week. An attack paid for is the same bad week, plus funding, plus a target painted on the door.
See the test setup and the defences in action on the Technical Anshu channel, then come back and apply the settings on your own PC.
Watch Full VideoBecause enough victims do pay to keep the industry funded - which is precisely why every payment raises the odds for everyone else, including a repeat attack on the payer. Widespread refusal plus widespread backups is what shrinks the business model.
Yes - reporting is quick, helps authorities connect your incident to a wider campaign, and may be an expectation for organisations under CERT-In directions. It also creates the official record an insurer or auditor may later ask for.
Generally, no - there is no master key, and recovery in most cases comes from your own backups. Occasionally, when a criminal group's infrastructure is seized, decryption keys are released publicly through official channels - another reason a filed report and preserved evidence are worth having.