# Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)

> K7 CyberSecurity says ransomware that makes personal data inaccessible, even without data theft, may be a reportable personal data breach under India's DPDP framework, with no minimum breach-size exemption. Affected individuals and the Data Protection Board must be notified without delay, with a detailed report due within 72 hours of awareness unless extended.

- **Published:** 2026-11-12T21:38:42Z
- **Last reviewed:** 2026-11-12T21:38:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5895
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5895.png
- **ID:** TL-2026-5895
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 6

## Description

This is regulatory and compliance intelligence, not an exploited vulnerability or a named-actor campaign. No CVE, malware family, threat actor, PoC or network infrastructure is stated in any source, so the IOC list below contains only the organizations, regulatory bodies and behavioral techniques that are relevant to defenders; it has no malicious infrastructure indicators.

In a media briefing reported by the Free Press Journal (updated 2026-11-12), K7 CyberSecurity argued that ransomware which renders personal data inaccessible may count as a personal data breach under India's Digital Personal Data Protection (DPDP) framework even when no data is exfiltrated. K7 states that the framework has no minimum breach-size exemption once an incident meets the statutory definition. Affected individuals and the Data Protection Board must be notified 'without delay', and a detailed report is due within 72 hours of the data fiduciary becoming aware of the breach unless an extension is permitted. K7 also describes penalties of up to INR 250 crore for failures involving reasonable security safeguards and up to INR 200 crore for breach-notification violations, and stresses that penalties are not automatic.

Timeline: the DPDP Rules, 2025 were notified in November 2025 (sources give 13 or 14 November). Consent Manager registration begins 2026-11-13, which K7 says is not the general enterprise compliance deadline. The major privacy, cybersecurity and breach-notification obligations take effect on 2027-05-13 (18 months after notification for Rules 3, 5-16, 22 and 23 per SCC Online). Independent legal summaries agree on the core Rule 7 mechanics (initial intimation without delay; detailed particulars within 72 hours, extendable by the Board on written request) but differ in wording: one summary describes Board notification 'within hours', and another notes the notification format is not prescribed. Verify against the Gazette text before relying on the exact 72-hour mechanics.

Defensive relevance: K7 recommends maintaining reliable evidence of data access, security controls and incident investigations, and integrating endpoint protection, cloud monitoring, privileged access management and SOC capabilities. It also advises assessing how AI systems process sensitive information, since security monitoring data can contain personal information. Rule 6 of the DPDP Rules (per SCC Online) requires reasonable safeguards including encryption, tokenisation, access controls, logging, audits, and backup and recovery, covering confidentiality, integrity and availability. Incident response playbooks for ransomware in India should therefore include a regulatory-notification decision step that does not depend on proof of exfiltration. MITRE mappings are analyst mappings: T1486 reflects the ransomware impact K7 discusses; the other techniques correspond to the control areas K7 recommends (endpoint protection, privileged access management) and typical ransomware lifecycle stages, and are not stated in the source.

## MITRE ATT&CK

- T1490 Inhibit System Recovery
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1685 Disable or Modify Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Server Process Spawning Shell or LOLBin — Ransomware Initial Access (T1190)** (`TL-2026-5895-SPL-001`)

TL-2026-5895 (K7 / DPDP Rules ransomware-reporting intel) is regulatory intelligence with no named malware or infrastructure, so detections are behaviour-first on the ransomware lifecycle that ends in T1486 data encryption and loss of availability of personal data. This rule detects the exploitation stage: an internet-facing web or application server process (IIS w3wp, Apache httpd, nginx, Tomcat, php-cgi, java) spawning a command interpreter or download LOLBin, the typical result of exploiting a public-facing application (T1190) before ransomware staging. Early detection supports the DPDP Rule 6 safeguard and Rule 7 incident-evidence expectations.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*w3wp.exe" OR ParentImage="*httpd.exe" OR ParentImage="*nginx.exe" OR ParentImage="*tomcat*.exe" OR ParentImage="*php-cgi.exe" OR ParentImage="*java.exe") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host ParentImage Image User | convert ctime(first_seen) ctime(last_seen) | sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "java.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server Process Spawning Shell or LOLBin
id: 5b0f7c1e-3a64-4d2b-9e1a-7c4a2f6d8b11
status: experimental
description: Detects an internet-facing web or application server process spawning a command interpreter or download LOLBin, consistent with exploitation of a public-facing application (T1190) ahead of ransomware staging (T1486). Related to TL-2026-5895.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://www.freepressjournal.in/business/indias-dpdp-rules-put-ransomware-attacks-under-the-scanner-k7-cybersecurity-flags-hidden-compliance-risks-for-businesses
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\java.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Web applications that legitimately shell out for administration or deployment tasks
    - Java-based management consoles launching helper scripts
level: high
```

**Known false positives:**

- Web applications that legitimately invoke cmd.exe or powershell.exe for deployment or health-check tasks
- Java-based admin consoles (e.g. Tomcat manager, Jenkins) launching helper scripts

**Tuning notes:** Baseline the (ParentImage, Image, CommandLine) tuples for 14 days and allowlist known deployment/health-check commands; restrict ParentImage to internet-facing hosts via an asset lookup; add Linux auditd/Sysmon-for-Linux equivalents (httpd/nginx/tomcat spawning sh/bash) where relevant.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Password Spray Followed by Successful Sign-in from Same IP — Valid Account Abuse (T1078) (locked: unlock with TL Creds)
- Microsoft Defender Tampering via Set-MpPreference, Exclusions or Service Stop — Impair Defenses (T1562) (locked: unlock with TL Creds)
- Mass File Rename Burst by a Single Process — Data Encrypted for Impact (T1486) (locked: unlock with TL Creds)
- Ransomware Recovery-Instruction File Creation — Data Encrypted for Impact (T1486) (locked: unlock with TL Creds)
- Boot Recovery and Backup Destruction via bcdedit, wbadmin or vssadmin Resize — Inhibit System Recovery (T1490) (locked: unlock with TL Creds)
- Backup and Database Service Stop Before Encryption — Pre-Encryption Impact Staging (T1489) (locked: unlock with TL Creds)
- Shadow Copy Deletion via vssadmin, WMIC, PowerShell or diskshadow — Inhibit System Recovery (T1490) (locked: unlock with TL Creds)
- SMB Admin Share Executable Staging Across Multiple Hosts — Ransomware Lateral Movement (T1021.002 / T1078) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [India's DPDP Rules Put Ransomware Attacks Under The Scanner, K7 CyberSecurity Flags Hidden Compliance Risks For Businesses](https://www.freepressjournal.in/business/indias-dpdp-rules-put-ransomware-attacks-under-the-scanner-k7-cybersecurity-flags-hidden-compliance-risks-for-businesses)
- [Digital Personal Data Protection Rules, 2025 - Key Highlights (SCC Online)](https://www.scconline.com/blog/post/2025/12/26/digital-personal-data-protection-rules-2025-key-highlights/)
- [Data Breach Notification - DPDP Rule 7 (TCSA)](https://www.tcsa.in/frameworks/dpdp/data-breach-notification)
- [Digital Personal Data Protection Rules 2025 notified (Mondaq)](https://www.mondaq.com/india/data-protection/1708164/digital-personal-data-protection-rules-2025-notified)
- [Govt notifies final DPDP Rules; sets staggered rollout with key obligations for Data Fiduciaries (Storyboard18)](https://www.storyboard18.com/amp/digital/breaking-govt-notifies-final-dpdp-rules-sets-staggered-rollout-with-key-obligations-for-data-fiduciaries-84201.htm)
- [DPDPA Technical Implementation Playbook: 13-Month Roadmap to May 2027 (Ogma)](https://ogma.in/blog/dpdpa-technical-implementation-playbook-13-month-roadmap-to-may-2027)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5895