If you run security for an Indian company, the last stretch of August 2026 delivered a set of numbers worth sitting with — not to alarm anyone, but because together they point to a clear, doable priority for the next few quarters.
Two pressures are arriving at the same time. Attackers are targeting Indian organizations more than any other in the region, and the cost of getting breached is climbing. Meanwhile, India’s Digital Personal Data Protection Act (DPDPA) is moving toward enforcement, with real financial penalties attached. The encouraging part — and the point of this post — is that the work you do to protect data from attackers is largely the same work DPDPA asks of you. One investment, two returns. Let us break down the picture and a practical way forward.
The Numbers, in Plain Terms
India is the most-targeted APAC country for ransomware. According to a report from cybersecurity firm Cyble, India recorded the most ransomware incidents in the Asia-Pacific region in Q1 2026. That is not a distant, abstract threat — it is the region’s attackers concentrating on organizations like yours.
The cost of a breach is rising fast. The average cost of a data breach in India reached an all-time high of Rs 25.5 crore in 2026, up 16% year over year, according to an IBM-cited report. The trend line is going the wrong way.
Regulated sectors are under sustained pressure. India’s national response team, CERT-In, has detected and mitigated more than 9.2 lakh incidents of malicious scanning and probing against the banking and healthcare sectors over roughly a year and a half. If you are in financial services or healthcare, this is your daily background radiation.
And the compliance clock is ticking. DPDPA carries penalties of up to Rs 250 crore for significant failures to protect personal data, with enforcement expected around mid-2027. That is a board-level number attached to a fixed timeline.
Put simply: the likelihood of being targeted is up, the cost of a breach is up, and a new law with heavy penalties is on the way. The natural question is “where do I focus?” — and the answer is more reassuring than the numbers suggest.
The Insight: Ransomware Defense and DPDPA Readiness Are the Same Work
Here is what ties these threads together. Ransomware and mass data theft almost always follow the same path: an attacker gets in (often via stolen credentials), moves toward where the valuable data lives, and then reads, exfiltrates, or encrypts it. The data tier — your databases — is the destination.
DPDPA is, at its core, a set of obligations about that exact same data tier: know what personal data you hold, control who can access it, protect it, detect misuse, and be able to show what happened.
So the controls that stop an attacker from quietly reading your customer database are the same controls DPDPA effectively requires. You are not choosing between “security spend” and “compliance spend.” Done right, they are one spend.
Most organizations already have some of the outer layers — posture scanning (CSPM), and perhaps tools that tell them where sensitive data sits (DSPM). But there is a common and important gap: very few teams are actually watching who connects to the database, masking sensitive fields at query time, or blocking a destructive query before it runs. Knowing where your data lives is not the same as watching who touches it. That gap is where both the breach risk and the compliance risk concentrate.
The Questions You Should Be Able to Answer
Whether an attacker or an auditor is the one asking, these are the questions that matter — and being able to answer them is what closes both risks at once:
| Question | Why it protects against ransomware | Why it satisfies DPDPA |
|---|---|---|
| Who accessed this database, when, and what did they do? | Spots the anomalous access that precedes exfiltration. | Provides the access record regulators expect. |
| Does anyone have standing, always-on access they do not need? | Removes the long-lived credentials attackers reuse. | Demonstrates access is controlled and minimized. |
| Is sensitive data exposed to people who only need to see part of it? | Limits what a compromised account can read. | Supports data-minimization and protection duties. |
| Can a single query wipe or dump a table? | Blocks destructive or bulk-exfiltration actions. | Shows preventative controls are in place. |
| Where is our data physically stored and processed? | Reduces cross-border exposure. | Directly relevant to data-residency expectations. |
Notice that the security column and the compliance column are answered by the same capabilities. That is the whole point.
What You Can Do About It
This is a very actionable list, and you can adopt it in stages.
1. Start by watching the database, not just scanning the cloud around it
Add visibility at the data tier: who is connecting, from where, running what. Database activity monitoring turns your database from a black box into something you can see into — which is exactly where both ransomware exfiltration and DPDPA questions land.
2. Mask sensitive data at query time
Not everyone who needs database access needs to see full personal data. Dynamic masking shows a support engineer a masked version of an Aadhaar number, a phone number, or a card field while they do their job — so a compromised account (or a curious insider) cannot walk away with the real values.
3. Prevent destructive and bulk queries before they run
A control that can block a DROP TABLE on production, or a query that tries to pull an entire customer table at once, stops the single most damaging action in both a ransomware scenario and a data-leak scenario.
4. Eliminate standing access with just-in-time
Long-lived database and cloud credentials are what attackers reuse and what auditors flag. With just-in-time access, a person requests access for a specific task, it is approved, it lives for minutes, and it revokes itself. There is no permanent key to steal, and every session is recorded against a named identity.
5. Keep an identity-stamped audit trail
Make sure every database session and every privileged access carries a record: which identity, approved how, for how long, and what they did. This is the evidence that answers the auditor and shortens your own incident investigations.
6. Know — and be able to prove — where your data lives
DPDPA and customer trust both benefit from clear data residency. Being able to show that regulated data stays in-region, and controlling who can reach it, takes a whole category of hard questions off the table.
How Cloudanix Approaches This
Cloudanix is used by financial services and healthcare organizations across India precisely because it treats the data tier as first-class, not an afterthought. A few capabilities map directly to the ransomware-and-DPDPA overlap above.
Database Activity Monitoring watches who connects to your databases and what they do, with dynamic PII masking so sensitive fields are hidden at query time, and destructive-query prevention so a bulk dump or a DROP on production is stopped before it executes. Access can happen through the database tools engineers already use, and the audit record lands in your own storage — which matters for both investigation and data ownership.
Just-in-time access removes standing privilege across cloud and database tiers. Engineers, contractors, and non-human identities request scoped, time-boxed access that self-expires — the pattern that Indian FSI customers use to answer both auditor and cyber-insurer questions. Every session is identity-stamped.
Compliance and audit-evidence generation maps your posture and access controls to the frameworks you answer to — DPDPA readiness alongside SOC 2, ISO 27001, PCI, RBI, and others — so evidence exports rather than being assembled by hand at audit time.
Data residency and CloudPrem let you keep data in-region, and even run the entire platform inside your own cloud account with no data leaving it — a direct fit for organizations that need to prove where regulated data lives.
All of this runs on one platform, so the misconfiguration, the identity that can reach the data, the database session, and the compliance mapping are a single picture. And because it is agentless with a fast setup, you can start seeing value while the longer procurement and DPDPA-readiness work proceeds in parallel. To learn the regulation itself, our guide to DPDPA compliance is a good starting point.
Key Takeaways
- The pressure is real but focused. India leads APAC in ransomware targeting, breach costs are at record highs, and DPDPA brings Rs 250 crore penalties on a mid-2027 timeline. The response is a clear priority, not a panic.
- The data tier is the common ground. Ransomware wants your database; DPDPA is about your database. Securing it protects against both.
- Knowing where data lives is not enough. The gap most teams have is watching who touches the data — monitoring, masking, and query prevention at the database itself.
- Standing access is the shared weakness. Eliminating long-lived credentials with just-in-time access cuts breach risk and satisfies auditors in one move.
- One investment, two returns. Building data-tier security now means your DPDPA readiness is largely done as a byproduct — and you get there calmly, in stages, ahead of the deadline.
Want to see who can currently reach your most sensitive data — and get DPDPA-ready evidence in the process? Book a demo to see Cloudanix Database Activity Monitoring, just-in-time access, and data residency on your own environment.
People Also Read
- What is DPDPA Compliance?
- Database Activity Monitoring: Real-Time Data Security
- Database Activity Monitoring Use Cases: How DAM Prevents Data Loss
- Cloud Security for Financial Services: Compliance, JIT Access & Misconfig Playbook
- Cloudanix: Database JIT
- Cloudanix: Just-in-Time Access
- Cloudanix: Data Residency
