ABC Healthcare, a leading Indian healthcare technology company, was at the forefront of digitizing patient care by implementing a state-of-the-art digital health records system. In March 2024, ABC Healthcare suffered a s

ABC Healthcare, a leading Indian healthcare technology company, was at the forefront of digitizing patient care by implementing a state-of-the-art digital health records system. In March 2024, ABC Healthcare suffered a significant cyberattack that affected its cloud-based health records system that exposed sensitive medical data of millions of patients. The attack was sophisticated and multi-faceted, in which Hackers deployed ransomware that encrypted critical databases, including patient medical histories, insurance claims, and diagnostic reports. The attackers demanded a ransom of ₹50 crore (approximately USD 6 million) in cryptocurrency to restore access to the encrypted files. Before deploying the ransomware, the hackers exfiltrated sensitive data, including patient records, doctor consultations, billing information, and other Personally Identifiable Information (PII). This data was later found being sold on the dark web. Investigations suggested that the initial access point for the hackers was facilitated by a compromised employee's credentials, raising concerns about insider threats and inadequate internal controls. The consequences of the breach affect operational impact in which ABC Healthcare's systems were paralyzed for days, causing service disruption across hundreds of hospitals and clinics that depended on its health records system. Emergency healthcare services were significantly hampered, and patients could not access their medical records. The company consulted a leading cybersecurity firm specializing in digital forensics. Also, the Indian bodies, including the Ministry of Health and Family Welfare and the Indian Computer Emergency Response Team, launched investigations into ABC Healthcare's cybersecurity practices. The company was penalized for not adhering to security standards required for handling sensitive health data and suggested the security audit of the company. The breach severely damaged ABC Healthcare's reputation, leading to a decline in investor confidence and loss of clients. Hospitals and healthcare providers began migrating to other, more secure platforms. ABC Healthcare appoints the cyber experts for their recommendations in the security of the company data. The recommendations were: strengthening cybersecurity measures, timely and clear communication, streamline its internal reporting, third-party experts, preserve evidence, and ensure legal compliance, appointing a Data Protection Officer to oversee compliance, Training employees on cybersecurity threats. With the guidance of cybersecurity experts, the company has committed to strengthening its defenses by implementing multi-factor authentication, advanced threat detection systems, and encryption practices, as well as enhancing its incident response and compliance with future legislative reforms. The newly implemented security measures improved ABC Healthcare's operational resilience. By leveraging AI-powered threat detection and maintaining a trained cybersecurity team, ABC Healthcare was better equipped to handle emerging cyber threats. The company adopted a continuous improvement mindset, regularly updating its systems and protocols to adapt to the rapidly evolving cyber threat landscape. The Information Technology (Amendment) Act, 2008 was established to enhance the protection of personal data. Identify the relevant section(s) that prevent a company from claiming exemption when failing to maintain reasonable security practices.