--- title: "An Indian breach costs ₹25.5 crore on average; CERT-In’s caseload has grown 2.5×" summary: "CERT-In incident counts for 2020 to 2025, IBM’s Indian breach-cost studies for 2024 to 2026, and what a business should fund first, as of September 2026." url: https://www.thetechbag.com/blog/importance-cyber-security format: Analysis desk: "Security operations" published: 2025-02-11 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["CERT-In","data breach","IBM Cost of a Data Breach","phishing","supply chain","NIST 800-63B","passwords","MFA","DPDP","SEBI CSCRF"] cover: https://www.thetechbag.com/blog/covers/importance-cyber-security.png --- # An Indian breach costs ₹25.5 crore on average; CERT-In’s caseload has grown 2.5× *CERT-In incident counts for 2020 to 2025, IBM’s Indian breach-cost studies for 2024 to 2026, and what a business should fund first, as of September 2026.* Analysis · Security operations · By TechBag · Published 2025-02-11 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/importance-cyber-security The short version - IBM’s 2026 India study puts the average breach at **₹25.5 crore**, up 15.9% in a year, and CERT-In handled 29.44 lakh incidents in 2025, about 2.5 times its 2020 count.[3] [2] - Of the three most common ways into an Indian organisation in IBM’s 2026 data, phishing (19%), drive-by compromise (16%) and supply-chain compromise (15%), only the first is mainly an employee-habit problem.[3] - The 2023 version of this piece told staff to change passwords regularly and mix character types. NIST’s current standard forbids both. Fund MFA, patching and vendor controls before awareness posters.[5] In January 2023 we published a piece arguing that cyber security is a business problem, not an IT one, and closed it with nine things employees should do. The argument was right and the evidence was thin: a US$600 billion global estimate from 2018 and two American regulations. An Indian finance head deciding this year’s security budget needs something else: how often Indian organisations are hit, what a breach costs in rupees, where breaches actually start, and which of the old advice still holds. Those four questions are the four sections below, with every figure as of September 2026. ## CERT-In’s caseload grew two and a half times in five years The only official Indian count is CERT-In’s. Answering in the Rajya Sabha in February 2025, the Minister of State for Electronics and IT gave the incidents CERT-In recorded each year: 11,58,208 in 2020, 14,02,809 in 2021, 13,91,457 in 2022, 15,92,917 in 2023 and 20,41,360 in 2024.[1] A government statement in January 2026 added 2025: over 29.44 lakh incidents handled, with 1,530 alerts and 390 vulnerability notes issued.[2] **Figure: CERT-In handled 29.44 lakh incidents in 2025, 2.5 times the 2020 count and 44% more than 2024** *Cyber security incidents recorded or handled by CERT-In, lakh, calendar years 2020 to 2025* | | Incidents | | --- | --- | | 2020 | 11.58 | | 2021 | 14.03 | | 2022 | 13.91 | | 2023 | 15.93 | | 2024 | 20.41 | | 2025 | 29.44 | Source: Rajya Sabha reply, February 2025 (2020 to 2024); Government of India statement, 23 January 2026 (2025) · as of 30 September 2026 · 2025 is described as incidents handled; earlier years as incidents reported. Counts are not breaches TechBag countTechBag count 29.44 lakh divided by 11.58 lakh is 2.54; divided by 2024’s 20.41 lakh it is 1.44, a 44% rise in one year. Both ratios are TechBag arithmetic on the government’s own figures.[1] [2] Read the count for what it is. An “incident” to CERT-In includes a defaced website, a phishing domain and a scan that was reported, not only a breach, and part of any rise is better reporting since the 2022 Directions made reporting compulsory. But the six-hour reporting rule has been in force since June 2022, so the jump from 2024 to 2025 is not a reporting-rule effect.[8] The one sector breakdown CERT-In has published shows how much of the count is noise and how much is not. In an August 2026 Rajya Sabha reply, banking accounted for 5,70,108 incidents in 2025 and 3,48,607 in the first half of 2026; healthcare for 34,480 and 18,855. Of the finance-sector incidents, 4,70,445 in 2025 were malicious scanning and probing, and 39 were targeted intrusion campaigns against banks.[13] Most of the volume is someone knocking. The 39 are someone who got in and stayed, and those are the ones the next section prices. ## A breach in India now averages ₹25.5 crore IBM’s Cost of a Data Breach study, released in India on 3 August 2026, put the average total cost of a breach for an Indian organisation at ₹25.5 crore, an all-time high and 15.9% above the ₹22 crore of the 2025 study, which was itself 13% above 2024’s ₹19.5 crore.[3] [4] Financial services paid most at ₹40.9 crore, then technology at ₹35.7 crore and communications at ₹34.5 crore. The average breach exposed 39,500 records, up from 38,200 a year earlier.[3] **Figure: The average Indian breach cost ₹6 crore more in 2026 than in 2024** *Average total cost of a data breach, Indian organisations, ₹ crore, IBM study years 2024 to 2026* | | Average cost of a breach | | --- | --- | | 2024 | 19.5 | | 2025 | 22 | | 2026 | 25.5 | Source: IBM India newsroom, 7 August 2025 (2024 and 2025) and 3 August 2026 (2026) · as of 30 September 2026 · IBM studies a sample of breached organisations; the 2026 study covers breaches from March 2025 to February 2026 Speed is the other lever IBM measures. Organisations with no security AI or automation took 236 days to identify a breach and 75 to contain it, 311 in all; those using it extensively took 175 and 81, or 256.[3] Fifty-five days is the gap between finding the intruder in the third quarter and finding them in the second. The shadow-AI line deserves a sentence of its own because it is new and cheap to fix. ₹1.79 crore is what IBM attributes, on average, to breaches at organisations where staff used AI tools the company had not sanctioned, IBM’s “shadow AI”.[3] The control is an approved tool and a policy that says so, not a new security platform. Our view Our view: do not show your board ₹25.5 crore as your number. IBM’s sample leans to large organisations, and a 200-person firm will not lose that much on an average day. Show it the trend, 31% in two years, and the direction of the regulatory penalties, which do not scale down with company size. ## Where Indian breaches start, and what employees can stop IBM records the first way in. For India in 2026 the top three were phishing, including voice and SMS phishing, at 19%; drive-by compromise, where a user visits a compromised or malicious site, at 16%; and supply-chain compromise at 15%.[3] The 2025 study had phishing at 18%, third-party and supply-chain compromise at 17% and vulnerability exploitation at 13%.[4] **Figure: Phishing still leads, but the next two ways in are a browser and a supplier, not a careless click** *Share of Indian breaches by initial attack vector, top three, each out of 100 breaches, IBM 2026 study* 19% Phishing, incl. voice and SMS the one vector staff training mainly reaches 16% Drive-by compromise a patching and browser problem 15% Supply-chain compromise starts at a supplier Source: IBM India newsroom, 3 August 2026 · as of 30 September 2026 · IBM published only the top three vectors for India; the remaining 50% is not broken out TechBag countTechBag count We mapped the nine employee steps in the 2023 piece to these vectors. Five touch phishing or drive-by compromise: keep software updated, be careful with links and attachments, recognise social engineering, report suspicious activity, keep learning. None touches supply-chain compromise. Two, use a VPN and avoid public Wi-Fi, touch none of the three. The mapping is our judgement. The implication is uncomfortable for the habit-based approach. About one breach in seven in IBM’s Indian data starts at a supplier, and no amount of staff training reaches a supplier’s build server. Drive-by compromise is mostly a patching and browser-isolation problem that sits with IT, not with the person who clicked. The year-on-year change points the same way. In the 2025 study, vulnerability exploitation was the third vector at 13%; in 2026 it left the top three and drive-by compromise entered at 16%.[4] [3] Supplier compromise held near one in six both years. Two consecutive Indian studies, in other words, put the vendor relationship and the unpatched endpoint level with the phishing email. ## Half the 2023 checklist has aged, and two items are now wrong The 2023 list told staff to use passwords of at least 12 characters mixing upper and lower case, numbers and symbols, and to change them regularly. NIST’s revised digital identity guideline, SP 800-63B revision 4 (August 2025), now says verifiers “SHALL NOT require subscribers to change passwords periodically” and “SHALL NOT impose other composition rules”, and sets 15 characters as the minimum for a password used on its own.[5] Forced rotation produces `Summer2026!`; length and a second factor do not. **Figure: Two of the 2023 password rules are now prohibited by NIST; the rest move from habits to controls** *The 2023 employee checklist against current guidance and IBM's Indian vector data, September 2026* What the 2023 list asked of employees - Change passwords regularly - 12 characters with mixed character types - Use a VPN and avoid public Wi-Fi - Be careful with links; recognise social engineering - Back up your own files What the evidence supports now - No forced rotation; change on evidence of compromise (NIST) - 15 characters for single-factor use, no composition rules, plus MFA - Patch browsers and internet-facing systems; the drive-by vector is 16% - Phishing-resistant MFA, because training alone leaves the 19% - Supplier access reviews and central, tested backups the company owns Source: NIST SP 800-63B revision 4; IBM India 2026 · as of 30 September 2026 What survives is the instinct behind the list: report what looks wrong, and treat security as a business cost. What changes is who carries it. The controls that address the three leading Indian vectors, MFA, patching and supplier access, are bought and run by the company. Training is still worth paying for. It is not the first line of the budget. For a business funding this from scratch, we would sequence it like this, each line tied to a number above: 1. **MFA on email, VPN and every admin console.** It blunts the 19% that starts with phishing even when the training fails. 2. **Patch browsers and internet-facing systems on a clock.** The 16% drive-by vector and 2025’s 13% exploitation figure are the same discipline. 3. **A supplier register with access reviews.** Know which vendors can reach your systems and remove the ones that no longer need to; this is the 15%. 4. **Endpoint protection and 180 days of logs.** The first finds the intruder sooner; the second is what CERT-In requires and what you need to answer “where else?” 5. **Then training**, focused on reporting rather than memorising rules. If you are buying this in India Gartner expects Indian organisations to spend US$3.4 billion on information security in 2026, 11.7% more than in 2025, with security software the largest segment at US$1,556 million.[6] At the small end the entry ticket is modest: Seqrite Endpoint Protection Business lists on Indian reseller sites at ₹1,250 an endpoint a year before GST, so 200 endpoints cost ₹2,50,000, or ₹2,95,000 with 18% GST.[7] Most imported SaaS security is billed in USD and attracts the same 18% GST. The obligations are dated. The **CERT-In Directions** of 28 April 2022 require a reportable incident to reach CERT-In within six hours and ICT logs to be kept for 180 days in India.[8] The **DPDP Rules** were notified on 13 November 2025, with the security-safeguard and breach-intimation duties in force from 13 May 2027; the 2023 Act sets penalties of up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for failing to notify a breach.[9] [10] SEBI’s **CSCRF** has applied to regulated entities since 31 August 2025, and the**RBI** cyber resilience Directions of 31 July 2026 bind commercial banks.[11] [12] How we did this Figures as of 30 September 2026 CERT-In counts for 2020 to 2024 are the figures given in a Rajya Sabha reply in February 2025, as reported; the 2025 figure is a government statement of 23 January 2026, as reported. We did not obtain the Parliament record directly. The IBM figures are the two India releases, verbatim; IBM’s full report was not read, and IBM publishes only the top three Indian vectors. Ratios and the mapping of the 2023 checklist to vectors are TechBag arithmetic and judgement. The NIST quotations are from the published revision 4 text. The Seqrite price is a reseller list, not a vendor list. The 2018 US$600 billion estimate in the original was dropped because it could not be refreshed to a comparable figure. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [The Tribune, Cybersecurity incidents surge by 76.25% in five years (Rajya Sabha reply, MoS Jitin Prasada; 2020 to 2024 counts)](https://www.tribuneindia.com/news/ludhiana/cybersecurity-incidents-surge-by-76-25-in-5-yrs-reveals-minister-in-rs/amp) — 11 February 2025 2. [Morung Express, CERT-In handled over 29.44 lakh cyber incidents in 2025 (government statement)](https://morungexpress.com/cert-in-handled-over-2944-lakh-cyber-incidents-in-2025-gains-global-recognition) — 23 January 2026 3. [IBM India newsroom, India records its highest average cost of a data breach (₹25.5 crore; vectors; sectors; lifecycle; shadow AI)](https://in.newsroom.ibm.com/India-Records-its-Highest-Average-Cost-of-a-Data-Breach-2026) — 3 August 2026 4. [IBM India newsroom, India records highest average cost of a data breach (₹22 crore; ₹19.5 crore in 2024; vectors)](https://in.newsroom.ibm.com/2025-08-07-India-Records-Highest-Average-Cost-of-a-Data-Breach-IBM) — 7 August 2025 5. [NIST, SP 800-63B revision 4, Digital Identity Guidelines: Authentication and Authenticator Management (password rules)](https://pages.nist.gov/800-63-4/sp800-63b.html) — August 2025 6. [Gartner forecast via CXOToday, Information security spending in India to total US$3.4 billion in 2026](https://cxotoday.com/media-coverage/gartner-forecasts-information-security-spending-in-india-to-total-3-4-billion-in-2026/) — 9 March 2026 7. [Techjockey, Seqrite EPS for Business listing (Business ₹1,250 per endpoint, one year), as recorded on TechBag's Seqrite vs Kaspersky analysis](https://www.techjockey.com/detail/seqrite-eps-for-business) — recorded September 2026 8. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; 180-day logs in India)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 9. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — Rules notified 13 November 2025 10. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 11. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 12. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. 13. [Outlook Money, Rajya Sabha reply on CERT-In incidents in banking and healthcare, 2025 and January to June 2026](https://www.outlookmoney.com/news/banking-and-healthcare-sectors-saw-over-97-lakh-cyber-incidents-parliament) — 9 August 2026 Related on TechBag: the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) prices the first control in INR; the [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) covers the second factor NIST now assumes. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the first control, priced in INR - [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — the second factor NIST now assumes