Analysis Of Hacking And Ransomware Offences

08 Nov 2025 --
0 Comments

1. Introduction

Hacking and ransomware attacks are modern cybercrimes targeting:

Computer systems

Personal data

Financial information

Critical infrastructure

These offences involve:

Unauthorized access

Data breaches

Encryption of systems for ransom

Financial extortion

Destruction or manipulation of data

They threaten national security, corporate stability, and individual privacy.

2. Legal Framework

2.1 India

Information Technology Act, 2000

Section 43 – Unauthorized access, data theft

Section 66 – Computer-related offences (hacking)

Section 66F – Cyber terrorism

Section 67 – Publication of sensitive material

Section 70 & 70B – Protected systems, CERT-In notification

2.2 USA

Computer Fraud and Abuse Act (CFAA)

RICO Act in case of organized cybercrime

State cybercrime statutes

2.3 UK

Computer Misuse Act 1990

Serious Crime Act 2015

3. Elements of Hacking and Ransomware Offences

Unauthorized access to systems

Intent to cause damage or steal data

Use of malicious software or scripts

Demanding ransom for data decryption

Disruption of essential services

4. Case Studies (More Than Five)

Case 1: WannaCry Ransomware Attack (2017, Global)

Facts:

Massive ransomware outbreak affecting 150+ countries.

Exploited Windows vulnerability (“EternalBlue”).

Critical sectors hit: healthcare (NHS UK), telecom, transport.

Investigation & Analysis:

Attack attributed to a state-sponsored hacking group.

Large-scale digital forensics and global cooperation needed.

Legal Outcome:

Several jurisdictions issued indictments for cyber terrorism.

Highlighted weaknesses in outdated systems.

Principle:

Ransomware can be prosecuted under cyber terrorism, unauthorized access, and economic sabotage statutes.

Case 2: Sony Pictures Hack (2014, USA)

Facts:

Hackers stole confidential data, emails, and unreleased movies.

Threats issued to prevent release of a film.

Investigation:

Attack used malware to wipe systems.

Attributed to politically motivated hackers.

Legal Outcome:

DOJ filed criminal charges for cyber extortion, espionage, and computer intrusion.

Principle:

Hacking motivated by political retaliation falls under cyber espionage and sabotage laws.

Case 3: RBI – Cosmos Bank Cyber Heist (India, 2018)

Facts:

Coordinated malware attack on ATM servers.

Hackers siphoned off ₹94 crore through fraudulent ATM withdrawals across multiple countries.

Investigation:

Use of remote access, SWIFT manipulation, and malware injection.

Outcome:

Case filed under Sections 43, 66, 66B, and 66F of IT Act and IPC theft provisions.

Principle:

Demonstrates vulnerability of banking networks and prosecution under financial cybercrime categories.

Case 4: R v. Adam Mudd (UK, 2017)

Facts:

A teenager created Titanium Stresser, a DDoS-for-hire tool.

Used in over 1.7 million attacks globally.

Court Analysis:

Although young, the offender knowingly facilitated cyberattacks.

Outcome:

Convicted under Computer Misuse Act.

Principle:

Even minors involved in creating cyber tools are liable for aiding massive cyber offences.

Case 5: Yahoo Data Breach (2013–2014, USA)

Facts:

3 billion user accounts hacked.

Data stolen included names, passwords, phone numbers.

Investigation:

State-sponsored actors used spear-phishing and privilege escalation.

Outcome:

Indictments filed against foreign intelligence officers.

Principle:

Large-scale data breaches classified as cyber espionage and identity theft.

Case 6: Indian Railway Catering and Tourism Corp (IRCTC) Hack (India, 2016)

Facts:

Personal details of ~10 million users illegally accessed and sold on dark web.

Court Proceedings:

Police invoked IT Act §66 and §43.

Principle:

Highlights the significance of data protection and liability of institutions storing personal information.

Case 7: Colonial Pipeline Ransomware Attack (USA, 2021)

Facts:

Ransomware attack shut down major fuel pipeline supplying East Coast USA.

Panic buying and fuel shortages resulted.

Investigation:

Attack traced to a criminal hacking group using DarkSide ransomware.

Outcome:

Partial ransom paid; US government recovered a portion by tracking crypto wallets.

Principle:

Ransomware targeting essential services is treated as infrastructure sabotage and cyberterrorism.

5. Key Principles from Case Law

Legal Principle	Case Examples	Explanation
Unauthorized access is a criminal act	Sony Hack, IRCTC Hack	Accessing systems without owner’s permission is punishable.
Ransomware is treated as extortion	WannaCry, Colonial Pipeline	Encryption + ransom demand amounts to cyber extortion.
Cyber terrorism applies to attacks on critical systems	WannaCry, Cosmos Bank	Disruption of critical networks triggers severe penalties.
Data breaches = identity theft + espionage	Yahoo Breach, Sony Hack	Theft of personal data is a criminal offence.
Minors can also be liable for hacking	R v. Adam Mudd	Age does not exempt from cybercrime liability.
Financial cybercrime treated severely	Cosmos Bank Heist	Use of malware for financial theft attracts strict punishment.