The numbers, year by year
These are the totals the government reported to Parliament and in its 2025 year-end statement. They count all incidents CERT-In handled, from phishing sites and malware infections to website defacements and data leaks. Not every incident is a breach.
| Item | Value |
|---|---|
| 2020 | 11.58 |
| 2021 | 14.03 |
| 2022 | 13.91 |
| 2023 | 15.93 |
| 2024 | 20.41 |
| 2025 | 29.44 |
Why the curve bends upward
CERT-In's directions of 28 April 2022 made reporting mandatory within 6 hours of noticing an incident. Since then, more incidents are reported. Digital adoption also grew: more UPI payments, more online government services, and more small businesses with a website. A bigger attack surface brings more incidents.
What CERT-In did in 2025
| Item | Value |
|---|---|
| Security alerts issued | 1,530 |
| Vulnerability notes | 390 |
| Cyber drills and exercises | 122 |
What Indian businesses should do
- Know the 6-hour rule: report qualifying incidents to CERT-In within 6 hours of noticing them.
- Keep system logs for 180 days, stored in India, as the 2022 directions require.
- Sync server clocks to an official NTP source so logs line up during an investigation.
- Subscribe to CERT-In advisories and act on the ones that match your software.
- Run the free Cyber Swachhta Kendra tools on office machines.
Frequently asked questions
How many cyber incidents did CERT-In handle in 2025?
CERT-In handled over 29.44 lakh cyber security incidents in 2025, according to a government statement reported in January 2026.
How many cyber incidents were reported in India from 2020 to 2024?
CERT-In handled 11.58 lakh incidents in 2020, 14.03 lakh in 2021, 13.91 lakh in 2022, 15.93 lakh in 2023 and 20.41 lakh in 2024, as stated in the Rajya Sabha.
What is the CERT-In 6-hour rule?
Under CERT-In's directions of 28 April 2022, organisations in India must report specified cyber security incidents to CERT-In within 6 hours of noticing them, and keep system logs for 180 days.
