India lost over ₹20,000 crore to cyberattacks in 2025. In 2026, the attacks are getting smarter, faster, and more targeted. AI-written phishing emails, deepfake voice scams, and supply chain ransomware have replaced the crude mass-spam attacks of previous years. Here is a complete picture of the major hacks and data breaches that have defined cybersecurity in India in 2026 — and what every Indian internet user needs to do right now to protect themselves.

1. Tata Electronics — Apple and Tesla Secrets Stolen (June 2026)

The biggest tech-sector hack of 2026 in India. (cite index=”57-1″>Ransomware group World Leaks stole 204,341 files totaling 630.4 GB from Tata Electronics — Apple’s key iPhone manufacturing partner in India. The files included Apple iPhone 18 Pro component blueprints, quality inspection standards, Tesla engineering drawings, and employee passport scans. Tata Electronics confirmed the breach on June 22, 2026.

Who is affected: Tata Electronics employees (passport data exposed), Apple and Tesla (manufacturing IP exposed). iPhone consumers’ personal data was NOT exposed.
How it happened: World Leaks used compromised credentials or phishing to gain initial access — consistent with their established attack methodology.
What changed: Apple has launched a full security audit of all India supplier infrastructure. The breach will permanently raise the security bar for Indian companies in Apple’s supply chain.

2. India Financial Institutions — Cloud Misconfiguration Breaches (2025–2026)

(cite index=”49-1″>Multiple Indian financial institutions suffered data exposure in 2025–2026 due to misconfigured cloud storage buckets, exposing customer identity details and transaction logs. DSCI telemetry shows 62% of all Indian cybersecurity detections occurred in cloud environments, with misconfigured APIs, publicly exposed storage buckets, and excessive IAM permissions as the most exploited weaknesses.

This category of breach — not sophisticated hacking but simple misconfiguration — is the most common and the most preventable. Indian banks, fintech companies, and NBFCs are storing increasing volumes of customer data in cloud infrastructure that is frequently configured with default or overly permissive access settings. Customers of affected institutions are often never notified.

Who is affected: Customers of Indian financial institutions who have shared KYC documents, bank statements, or transaction records.
What to do: Check your bank’s app and website for any security notifications. Enable transaction alerts on your bank account. Monitor your CIBIL score for unexplained changes that could indicate identity theft.

3. Pakistan-Aligned APT Campaign Against Indian Government and Defence (January 2026)

(cite index=”45-1″>In January 2026, a Pakistan-aligned group launched a hacking campaign targeting Indian government, academic, and strategic institutions. (cite index=”49-1″>A related hybrid warfare campaign blending APT36, SideCopy, and hacktivist attacks has been documented targeting India’s defence and government networks. The campaign exploits malicious MSI packages delivered via spear-phishing or compromised software distribution channels to establish persistent access.

State-sponsored cyberattacks on India are not new, but the 2026 campaign is notable for its sophistication and its targeting of academic and research institutions — not just government networks. Universities and research bodies involved in defence-related research are increasingly targeted as entry points to sensitive information.

Who is affected: Government employees, defence personnel, academic researchers at institutions connected to strategic research.
For institutions: Mandatory security awareness training, multi-factor authentication on all remote access systems, and zero-trust network architecture are the minimum response.

4. The NVIDIA GeForce NOW Breach — India Users Affected (May 2026)

(cite index=”45-1″>In May 2026, NVIDIA confirmed a significant data breach involving its GeForce NOW cloud gaming platform, specifically targeting GFN.am, a third-party Alliance partner. An unidentified threat actor compromised the regional operator’s infrastructure to exfiltrate personal records of local users — names, phone numbers, and email addresses. The attackers subsequently attempted to extort the company for $100,000.

Indian gamers using NVIDIA’s GeForce NOW cloud gaming service through regional partners should verify whether their data was exposed. NVIDIA’s core systems were not compromised, but third-party regional operators — which are common for cloud gaming services distributed in India — may have had inadequate security controls.

What to do: If you use GeForce NOW through a third-party partner, change your password and enable 2FA on the associated email address.

5. The 2026 Threat Landscape: AI-Powered Attacks Are Here

(cite index=”50-1″>2026 is seeing AI-written phishing emails, deepfake voice scams, and unsecured cloud storage as the dominant threat vectors. The DPDP Act raises the stakes on all of it.

(cite index=”50-1″>Check Point clocked 3,195 attacks a week per Indian organisation in 2025, and there is no sign of it dropping. The most significant shift in 2026’s threat landscape is the weaponisation of AI by attackers:

AI-written phishing: Phishing emails are now indistinguishable from legitimate corporate communications in terms of grammar, formatting, and personalisation. The old advice — “look for spelling mistakes” — is no longer useful. AI can write a perfect phishing email impersonating your bank, your employer, or UIDAI in seconds.

Deepfake voice scams: A new category that is escalating rapidly in India. Scammers clone the voice of a known contact — a boss, a relative — and call victims requesting urgent money transfers. The voice is indistinguishable from the real person. Several high-profile incidents in India in 2026 have involved deepfake voice calls impersonating senior executives to authorise fraudulent wire transfers.

QR code phishing (Quishing): Malicious QR codes placed on physical locations — ATMs, restaurant tables, public notices — redirect users to fraudulent payment pages or install malware. Increasingly common in tier-2 Indian cities where QR code payments are the primary transaction method.

What Every Indian Should Do Right Now

These five actions take under 30 minutes and protect against the most common attack vectors targeting Indian users in 2026:

1. Enable two-factor authentication on your email account. Your email is the master key to every other account. 2FA on Gmail, Outlook, or Yahoo takes 5 minutes and blocks 99.9% of automated account takeover attempts.
2. Check haveibeenpwned.com for your email address. This free service tells you if your email and password have appeared in known data breaches. If they have, change the password immediately — especially if you reuse it across sites.
3. Never transfer money because of a phone call, even from a familiar voice. Call back the person using their number saved in your contacts before any transfer — deepfake voice scams only work if you don’t verify through a separate channel.
4. Enable transaction alerts on all bank accounts and cards. Real-time SMS and app alerts for every transaction let you catch unauthorised use immediately — minutes matter for fraud reversal.
5. Do not scan QR codes from public surfaces. If a restaurant, shop, or public notice uses a QR code for payment, ask for the UPI ID directly and type it in manually. A QR code that looks correct on a surface may have a fraudulent sticker placed over the original.

India’s Digital Personal Data Protection Act: What It Means for You

India’s DPDP Act is now in force, requiring organisations that handle Indian citizen data to notify CERT-In within 6 hours of a breach and affected individuals within 72 hours. For Indian consumers, this means you are now legally entitled to be notified if a company that holds your data suffers a breach. If you receive a breach notification from any app, service, or institution, take it seriously: change your password on that service, check your linked payment methods, and monitor related accounts for unusual activity.

Published September 9, 2026 · Digital Idea Tech News. For cybersecurity emergencies, contact CERT-In at incident@cert-in.org.in or the National Cyber Crime Reporting Portal at cybercrime.gov.in.