When the Supply Chain Becomes the Attack Surface

In June 2026, a leading electronics giant in India confirmed a cybersecurity incident following claims by ransomware group World Leaks that it had stolen and published more than 200,000 files, reportedly totalling over 630 GB.

Reports indicated that some of the allegedly exposed material was associated with their global customers, including Apple and Tesla. Reuters noted that it could not independently verify the authenticity of the entire dataset. Tata said the incident had no impact on its operations and that response protocols had been activated.

The incident highlights the interconnected nature of modern manufacturing ecosystems, where suppliers, customers and technology providers can create multiple pathways to sensitive information.

The lesson: Third-party cyber risk can no longer be treated as a procurement or compliance exercise. Organisations need visibility into which suppliers have access to critical systems and data, and how quickly that access can be contained.

Ransomware Becomes an Operational Risk

On June 23, 2026, another automobile legacy giant disclosed a ransomware attack affecting systems at the company and its wholly owned subsidiary. The company activated its response protocols and reported the incident to CERT-In.

For a manufacturer, ransomware is more than a data-security problem. IT and operational technology environments span production, engineering, supply chains, logistics and business applications.

The lesson: Industrial cybersecurity needs to be built around operational resilience. The objective is not only to prevent compromise, but to contain threats without unnecessarily disrupting production.

Identity Is Becoming the New Perimeter

In July 2026, a nationalised bank in India confirmed a cybersecurity incident involving a compromised employee email account. Reports subsequently emerged of customer data and internal documents appearing on the dark web. The bank said its core banking systems remained secure and initiated a forensic investigation.

The incident illustrates a broader change in enterprise security: attackers do not always need to penetrate the primary perimeter when a legitimate identity can provide access to sensitive resources.

The lesson: Organisations need to continuously assess not just who is accessing a system, but what they are doing once they get there.

Critical Infrastructure Extends Beyond the Facility

In July, files reportedly associated with a Nuclear Power Project in South India were published by ransomware group World Leaks. Reports indicated that around 19,000 files were exposed.

Authorities maintained that the breach did not involve the plant’s core nuclear systems.

Contractors and technology providers can hold sensitive infrastructure information even when core operational systems remain isolated.

The lesson: Critical infrastructure cybersecurity cannot stop at the facility perimeter. The security of contractors, suppliers and connected environments can influence the resilience of the infrastructure they support.

Not Every Cyber Incident Is a Data Breach

In June 2026, an education board in India reported coordinated cyber-attacks against its Post-Result Services Portal. The attacks involved large volumes of malicious traffic and appeared intended to disrupt the platform. The Board said its systems and databases remained secure and that no data breach had been detected.

This incident is important because it was not a confirmed data breach. Cybersecurity incidents can involve data theft, ransomware, denial of service, credential compromise, malware or attempted unauthorised access.

The lesson: Availability is a security objective. Resilience means being able to absorb an attack while continuing to deliver critical services.

Individual incidents tell only part of the story. Together, they reveal several broader cybersecurity trends in India.

1. Ransomware Is Becoming a Resilience Problem

Ransomware remains one of the most consequential cyber threats facing Indian organisations. The model has evolved, with attackers increasingly combining data theft with extortion, creating pressure even when organisations maintain reliable backups.

Ransomware preparedness therefore cannot stop at recovery. Organisations need to know which systems are critical, how quickly they can be isolated, and how quickly clean systems can be restored.

2. The Supply Chain Is Part of the Attack Surface

Multiple incidents demonstrate different versions of the same challenge. An organisation may have strong controls over its own environment while remaining exposed through a supplier, contractor or technology partner.

As businesses depend more on cloud platforms, managed services and interconnected ecosystems, security teams need visibility into critical dependencies and access pathways, rather than relying only on periodic vendor assessments.

3. Identity Has Become a Critical Security Boundary

The banking incident highlights why identity security deserves greater attention. Attackers increasingly target credentials because valid credentials allow them to operate inside an environment without immediately triggering the alarms associated with traditional malware.

Strong authentication, privileged access management and behavioural analytics are therefore fundamental controls.

4. OT Cybersecurity Requires a Different Mindset

India’s manufacturing and industrial sectors are becoming more connected. OT environments are fundamentally different from conventional IT, with availability, safety and process integrity often taking precedence over confidentiality.

A security control that is appropriate for IT may be unsuitable for a live industrial environment if it affects production. For organisations operating critical industrial environments, IT-OT convergence therefore makes cybersecurity a business continuity issue, not simply an IT issue.

5. AI Is Raising the Stakes

AI is changing the economics of cyber-attacks. IBM’s 2026 Cost of a Data Breach Report found that the average cost of a data breach in India reached ₹25.5 crore, up 15.9% from the previous year. It also reported that 26% of malicious breaches in India were AI-generated, while phishing remained the most common initial attack vector.

AI gives attackers greater ability to scale reconnaissance and social engineering, create AI-assisted phishing, generate deepfakes and automate aspects of an attack. It can also strengthen detection, investigation and response.

The challenge is to use AI securely and govern it effectively.

Cybersecurity and data protection can no longer be treated as completely separate conversations. A compromised identity, supplier or application can expose not only systems, but personal and business data.

For Indian organisations, this makes security controls increasingly relevant to privacy and data-protection obligations. Data mapping, access governance and breach readiness need to work together.

The lessons from 2026 point towards a shift from prevention-centric security to cyber resilience.

• Know what matters: Identify critical assets, business processes, data and operational dependencies. Maintain a current view of critical systems and prioritise their recovery.

• Secure identities: Strengthen authentication and privileged access controls and continuously monitor high-value accounts for unusual activity.

• Treat third parties as part of the environment: Map critical suppliers and dependencies with privileged or persistent access. Review that access regularly and define clear revocation processes.

• Build OT security around operations: Maintain OT asset visibility, segment critical environments and validate controls without disrupting production.

• Monitor exposure continuously: Track internet-facing assets, vulnerabilities and third-party exposure. Prioritise remediation by business and operational impact.

• Rehearse incident response: Test incident-response plans, escalation paths and recovery procedures through tabletop exercises and recovery drills.

The major cyber-attacks in India in 2026 point to a fundamental shift in the threat landscape.

Cyber risk no longer sits within a single network, system or organisation. It moves through identities, suppliers, connected environments and critical operations.

Resilience depends on knowing where those connections exist, what they expose and how quickly threats can be contained.

At 63SATS, we help organisations build that visibility and strengthen security across IT, OT and connected environments. From identifying vulnerabilities to detecting threats and protecting critical operations, our approach is designed to help businesses stay resilient as the threat landscape evolves.

The goal is no longer simply to keep attackers out. It is to ensure your business can keep moving when they get in.

1. What are the key cybersecurity trends in India in 2026?

Key trends include ransomware, supply-chain exposure, identity-based attacks, increasing IT-OT convergence, attacks on public-facing digital services and AI-enabled threats.

2. How is AI changing cyber-attacks?

AI can help attackers scale reconnaissance, phishing and social engineering, as well as create convincing deepfake and impersonation content. It can also strengthen defensive detection and response.

3. Why is ransomware an operational risk?

Ransomware can disrupt more than data and applications. In connected businesses, an attack can affect production, logistics, engineering, supply chains and other critical processes.

4. What should Indian organisations prioritise in 2027?

Organisations should prioritise continuous exposure monitoring, identity security, third-party risk management, OT cybersecurity, incident-response readiness and recovery testing, while bringing cybersecurity and data protection closer together.