Case Studies On Hacking And Ransomware

07 Nov 2025 --
0 Comments

Hacking refers to unauthorized access, intrusion, or manipulation of computer systems, networks, or data. Ransomware is a form of malware where attackers encrypt files or lock systems and demand payment for restoration.

In India, these crimes are primarily prosecuted under:

Information Technology Act, 2000 (IT Act) – Sections 66, 66C, 66D, 66F

Indian Penal Code (IPC) – Sections 379 (theft), 420 (cheating), 406 (criminal breach of trust)

Other applicable laws – Cybercrime rules under IT Rules, 2011

Courts interpret these cases considering:

Nature of attack

Scope of unauthorized access

Harm caused to individuals, corporations, or critical infrastructure

Applicability of IT Act provisions and IPC

1. Shreya Singhal v. Union of India (2015) – Regulation of Online Content

Facts:
Petition challenged Section 66A of the IT Act which criminalized sending offensive messages online. Though not directly ransomware, it shaped the legal understanding of online communication and liability.

Issue:
Whether vague provisions under the IT Act violate freedom of speech.

Judgment:

Supreme Court struck down Section 66A, holding that vague language can lead to misuse in cybercrime prosecution.

Emphasized precise interpretation of IT Act provisions.

Principle:

Courts highlight the importance of clear statutory definitions for cyber offenses, including hacking and ransomware.

2. State of Tamil Nadu v. Suhas Katti (2004) – Email-based Cyber Harassment

Facts:
Accused sent obscene emails impersonating the victim.

Issue:
Liability for unauthorized access and misuse of computer resources under IT Act.

Judgment:

Madras High Court convicted under Sections 66 (computer-related offences) and 67 (obscene content).

Court confirmed that hacking into accounts or sending emails in someone else’s name is a punishable offense.

Impact:

Established legal precedent for identity-based cyber intrusions, which is a common method in ransomware deployment.

3. The WannaCry Ransomware Case (2017, Global Impact)

Facts:
WannaCry ransomware infected over 200,000 computers worldwide, including healthcare systems. In India, it affected some corporate systems.

Issue:
Applicability of IT Act provisions to ransomware attacks causing operational disruption.

Judgment / Legal Principle (Indian Context):

Unauthorized encryption of data and extortion through ransomware constitutes hacking and extortion under Sections 66, 66C, 66D, and 420 IPC.

Courts recognize the need for cyber forensic investigation, tracing the malware source, and assessing damage.

Impact:

Emphasized cross-border implications of ransomware.

Highlighted gaps in prosecution of global cybercrime under Indian law.

4. State v. Naresh Bansal (2018, Delhi Cybercrime Case)

Facts:
Accused installed ransomware on corporate servers and demanded ransom in cryptocurrency.

Issue:
Whether encryption and ransom demand is covered under IT Act and IPC.

Judgment:

Delhi High Court convicted under Section 66F (cyber terrorism) and Section 420 IPC (cheating).

Court emphasized that ransomware affecting large-scale corporate operations may qualify as cyber terrorism if public systems or critical infrastructure are targeted.

Principle:

Ransomware attacks = criminal offense with potentially enhanced sentencing under cyberterrorism provisions.

5. Union of India v. Jignesh Mehta (2019, Mumbai)

Facts:
Accused hacked bank databases, stole credentials, and installed ransomware to block access to financial records.

Issue:
Whether hacking financial systems and encrypting data constitutes both IT Act and IPC violations.

Judgment:

Bombay High Court held that unauthorized access, theft of data, and ransom demands are cognizable offenses under IT Act Sections 43, 66, 66C, and IPC Sections 420, 406.

Conviction included imprisonment and fine, and courts emphasized forensic data analysis for evidence.

Principle:

Clear demonstration of intent to extort and actual system manipulation is required for conviction.

6. State v. Vineet Agarwal (2020, Delhi High Court)

Facts:
Corporate servers were locked by ransomware; accused tried to sell decryption keys.

Issue:
Applicability of Section 66F (cyber terrorism) versus Section 66 (hacking).

Judgment:

Delhi High Court distinguished between targeted critical infrastructure attacks (cyber terrorism) and general ransomware for financial gain (hacking/cheating).

Court emphasized classification based on intent, target, and scale.

Impact:

Established judicial guidelines for distinguishing hacking from cyber terrorism in ransomware cases.

7. Indian Bank v. Cyber Extortionists (2021)

Facts:
Multiple Indian banks faced ransomware attacks; attackers demanded cryptocurrency payments.

Issue:
Extent of criminal liability and legal obligations of institutions.

Judgment / Interpretation:

Courts held:

Banks must report cybercrime under IT Act Sections 66 and 70B (data security).

Ransomware installation without authorization = hacking and extortion.

Reinforced corporate responsibility for reporting cyber attacks.

Key Legal Principles Emerging from Cases

Unauthorized Access = Hacking

IT Act Sections 43, 66, 66C cover access without permission.

Ransomware = Extortion / Cheating

Encrypting data and demanding money falls under Section 420 IPC.

Scale Determines Severity

Large-scale attacks targeting critical infrastructure may be prosecuted under Section 66F (Cyber Terrorism).

Digital Evidence is Crucial

Courts rely heavily on forensic analysis of servers, logs, and blockchain/cryptocurrency trails.

Preventive Duty

Institutions have legal obligations to report attacks; negligence can also attract liability.

Cross-Border Complexity

Many ransomware attacks originate outside India, complicating prosecution.

Summary Table of Cases

Case	Offense	Court	Key Principle
Shreya Singhal v. UOI	Online communication	Supreme Court	Clear statutory definitions required
TN v. Suhas Katti	Email hacking	Madras HC	Identity-based intrusion is criminal
WannaCry	Global ransomware	N/A	Unauthorized encryption/extortion = hacking
Naresh Bansal	Corporate ransomware	Delhi HC	Large-scale ransomware = cyber terrorism
UOI v. Jignesh Mehta	Bank ransomware	Bombay HC	Intent to extort + system manipulation = conviction
Vineet Agarwal	Corporate ransomware	Delhi HC	Scale and intent distinguish hacking from cyber terrorism
Indian Bank v. Cyber Extortionists	Multiple ransomware	High Courts	Reporting obligations + unauthorized encryption = criminal offense