Top Cyber Crime Cases in India (2025–2026)

India has witnessed an unprecedented surge in cybercrime between 2025 and mid‑2026, driven by rapid digitisation, fintech proliferation, and sophisticated social‑engineering scams. During 2025 alone, over 28 lakh cybercrime complaints were recorded on official platforms, with estimated losses of about ₹22,495 crore, even as digital arrest scams, investment frauds and sextortion expanded nationwide. The period also saw nation‑state backed campaigns during Operation Sindoor, large‑scale attacks on critical infrastructure and banking systems, and high‑value fraud networks operating from abroad.[^1][2][^3][4][^5][6]

The “top” cybercrime cases in 2025–2026 can be selected either by financial impact, number of victims, legal importance, or their illustrative value for India’s evolving cyberlaw framework. This report focuses on ten representative, high‑impact cases and clusters that collectively capture the dominant patterns: digital arrest scams, cross‑border fraud networks, investment‑linked cyber fraud, attacks on healthcare and critical infrastructure, and mass‑scale data and endpoint compromise.

1. Digital Arrest Scam Epidemic and Supreme Court Suo Motu Proceedings

Digital arrest scams involve fraudsters impersonating police, CBI, ED or judicial officers on voice or video calls, placing victims under so‑called “digital arrest” and coercing them to transfer large sums to mule accounts. Official data and media investigations show that Indians have lost tens of thousands of crores to these scams in recent years, with losses of about ₹3,000 crore reported in one confidential report cited before the Supreme Court in November 2025.[^7][8][^9][10]

These scams rely heavily on deepfake audio/video, fake online courtrooms, and misuse of personal data obtained through phishing and social‑media profiling. In response, the Supreme Court initiated suo motu proceedings in “In Re: Victims of Digital Arrest” after an elderly Ambala couple was defrauded of over ₹1 crore, and has examined the role of banks, telecom operators, enforcement agencies and the regulatory framework for large‑value transfers. The Court’s scrutiny is likely to influence future jurisprudence on intermediary liability, due diligence obligations and coordinated national response to organised cyber fraud.[^8][10][^11][7]

2. Maharashtra ₹58 Crore Businessman Digital Arrest Case

Among individual digital arrest cases, the Maharashtra ‘businessman scam’ gained prominence due to its sheer amount and sophistication. A 72‑year‑old businessman from Mumbai was virtually detained over weeks through fake video‑call interrogations and simulated court proceedings, ultimately being coerced into transferring about ₹58.13 crore to 6,500+ layered bank accounts opened in the names of bogus companies.[^12]

Maharashtra Cyber arrested seven persons connected to the fraud and unearthed a complex laundering architecture involving thirteen layers of mule accounts. The case illustrates the scale at which organised cyber syndicates can move funds, the weakness of KYC and transaction‑monitoring systems, and the need for stronger reporting, freezing and reversal mechanisms within the banking system.[^12]

3. High‑Value Elderly Victim Cases: Mumbai ₹20.25 Crore and Gurugram ₹5.85 Crore Losses

An 86‑year‑old woman in Mumbai lost about ₹20.25 crore between December 2024 and March 2025 in one of India’s longest‑running digital arrest scams, after callers convinced her that her Aadhaar had been used for money‑laundering and threatened legal action against her family. She was kept under virtual confinement and repeatedly coerced to transfer funds to multiple accounts, highlighting how sustained psychological manipulation can override normal suspicion.[^13]

In another widely reported case, a woman in Gurugram lost about ₹5.85 crore (₹58.5 million) to similar digital arrest fraudsters and later questioned why her bank did not intervene despite multiple large transfers. Her case, taken up before consumer fora, raises issues of banking due diligence, real‑time fraud analytics and customer‑protection standards for vulnerable users.[^8]

4. Cross‑Border Dubai‑Linked ₹250 Crore Cyber Fraud Network

In July 2026, Gujarat Police’s cyber unit uncovered a Dubai‑linked cyber fraud network alleged to have siphoned off over ₹250 crore through coordinated online scams. The investigation led to the arrest of 19 accused across five cities, including an MBA student, and connected them to at least 146 cybercrime cases registered in 21 states.[^14]

Police indicated that the network was linked to more than 101 FIRs nationwide, with confirmed fraud amounts exceeding ₹46 crore from those cases alone. This multi‑state investigation illustrates the transnational character of modern cybercrime, dependence on overseas command structures and the need for international cooperation, MLAT‑based evidence exchange and harmonised asset‑tracing procedures.[^14]

5. Nationwide Operation Sindoor Cyber Offensive (May 2025)

During Operation Sindoor, India’s military response to the Pahalgam terror attack in April 2025, cyberspace became an active theatre of conflict. Seqrite Labs and other cybersecurity firms reported more than 650 coordinated cyber incidents in early May 2025, targeting defence PSUs, healthcare institutions, telecom providers and state‑run educational portals using spear‑phishing campaigns, remote‑access trojans and DDoS attacks.[^4][5][^6]

Hacktivist collectives and Pakistan‑aligned APT groups attempted to deface government websites, disrupt services and exfiltrate sensitive data, though most attempts were thwarted. NSE’s CEO later disclosed that during the height of Operation Sindoor, the exchange’s website faced about “40 crore” attack attempts within ten minutes, against a baseline of roughly 20 crore attacks per day, underscoring the resilience requirements for financial‑market infrastructure. This campaign is pivotal for understanding cyber‑warfare norms, attribution challenges and the interface between national security law and cybercrime statutes.[^5][6][^15]

6. Ransomware Attacks on Delhi Hospitals (June 2025)

In June 2025, two major Delhi hospitals reportedly faced crippling ransomware attacks that locked critical systems, forcing staff to revert to manual processes and disrupting patient care. These incidents occurred amid a global spike in ransomware targeting healthcare, with India’s healthcare sector among the most attacked according to threat‑intelligence reports.[^16][4]

The Delhi hospital attacks exposed weaknesses in backup policies, network segmentation, patch management and incident‑response planning within healthcare institutions. They also raised sensitive questions about data‑protection obligations under the Digital Personal Data Protection Act, sectoral regulations, and potential liability for failure to secure patient records and continuity of essential services.[^16]

7. Large‑Scale Endpoint and Malware Detections: Seqrite India Cyber Threat Report 2026

Seqrite’s India Cyber Threat Report 2026 analysed data from more than 8 million endpoints between October 2024 and September 2025, recording about 265.52 million detections—roughly 7.27 lakh detections per day and 505 per minute. Trojans and file‑infector malware constituted nearly 70% of attacks, with over 88.4 million Trojan detections and 71.1 million file‑infector detections in that period.[^4]

Cryptojacking detections reached about 6.5 million, while network‑based exploits exceeded 9.2 million, frequently targeting WordPress plugins, Apache Tomcat and SysAid systems. Geographically, Maharashtra, Gujarat and Delhi emerged as the most affected states, and sectors like education, healthcare and manufacturing accounted for almost 47% of detections. While this is a threat‑landscape study rather than a single “case”, it represents a macro‑level incident cluster of national importance.[^4]

8. Investment‑Related Cyber Frauds and Online Scam Syndicates

Investment‑linked cyber frauds—fake trading apps, Ponzi‑style schemes, and high‑return offers promoted via social media and messaging platforms—were the largest contributor to financial loss from cybercrime in 2025. Ministry of Home Affairs data show that such investment frauds accounted for about 76% of total financial loss from reported cybercrime that year.[^3][1]

These schemes often combine unauthorised use of payment gateways, fake SEBI‑style branding and remote‑access tools to siphon funds from retail investors. Together with digital arrest frauds (9% of loss) and sextortion (4% of loss and 19% of total cases), they demonstrate how cybercrime has shifted from traditional hacking towards large‑scale social‑engineering and financial crime ecosystems.[^17][3]

9. Surge in Cybercrime Against Women and Children (NCRP Data 2025)

Data presented in Parliament and reported in the media show a sharp surge in cybercrime against women and children, particularly in 2025. Complaints on the National Cyber Crime Reporting Portal (NCRP) relating to sexually obscene material, sexually explicit content, rape or gang‑rape related abusive material and child sexual abuse material rose to 76,657 in 2025, up from 48,335 in 2024.[^18][19]

Within these, sexually obscene material accounted for about 37,743 complaints, sexually explicit acts for 19,703, rape/gang‑rape content for 8,780, and child sexual abuse material for 10,431 cases. Online and social‑media‑related crimes—including cyberstalking, fake profiles and identity theft—also increased dramatically, reaching 1,73,766 complaints in 2025; this cluster of offences, while not a single case, represents a critical pattern of victimisation requiring specialised legal and enforcement responses.[^19][18]

10. Multi‑State Crackdowns on Cyber Fraud: Odisha ‘Cyber Kavach’ and Myanmar Scam Hub Rescues

Police forces have launched large‑scale crackdowns on cyber fraud networks, notably the Odisha Police ‘Cyber Kavach’ operation and international rescues from Myanmar‑based scam hubs. Under Cyber Kavach, Odisha Police reportedly verified over 37,000 mule bank accounts, registered 1,185 cybercrime cases and made more than 500 arrests linked to laundering and facilitation of online frauds.[^20][21]

In parallel, coordinated operations by Thailand, Myanmar and China rescued over 500 Indian youths who had been trafficked to a scam hub in Myanmar and forced to work in cyber fraud schemes targeting Indian citizens. These enforcement actions are important “cases” in their own right: they reveal the labour‑exploitation side of cybercrime, demonstrate cross‑border policing cooperation, and underline the need for stronger preventive measures to stop recruitment into such scam factories.[^20]

Statistical Context: Scale of Cybercrime in 2025–2026

Government and media data suggest that cybercrime incidents and losses have multiplied several‑fold over the last few years. In 2025, cybercrime complaints on the National Cyber Crime Reporting Portal rose to around 28.15 lakh from 22.68 lakh in 2024, marking a 24% increase, while estimated financial losses were about ₹22,495 crore.[^2][1][^3]

Other reports note that by June 30, 2025, over 12 lakh cybercrime cases had already been reported that year, with Maharashtra, Uttar Pradesh and Karnataka emerging as the most affected states. Meanwhile, cyberattacks on critical infrastructure, banks, stock exchanges and hospitals continue to rise, with NSE alone facing an average of 20 crore attack attempts per day. This backdrop explains why individual high‑profile cases like digital arrest scams and large fraud syndicates attract strong judicial, legislative and enforcement attention.[^15][2][^4]

Legal and Policy Implications

The period 2025–2026 has pushed Indian cyberlaw and enforcement to confront new challenges: deepfake‑driven impersonation, cross‑border scam compounds, mule‑account ecosystems and attacks on essential services. Digital arrest scams have catalysed debates on the adequacy of provisions under the Indian Penal Code, the Information Technology Act and allied statutes for dealing with highly organised, psychologically manipulative cyber offences.[^6][11][^7][20]

Policy responses include expansion of the Indian Cyber Crime Coordination Centre (I4C), strengthening of the National Cyber Crime Reporting Portal, awareness campaigns, and high‑level directions to banks and intermediaries to enhance fraud‑monitoring and KYC enforcement. However, the top cases discussed above indicate gaps in victim protection, asset recovery, inter‑agency coordination and international mutual legal assistance, suggesting that 2025–2026 will likely be seen as a formative period for comprehensive reforms in India’s cybercrime framework.[^22][23][^19][17]