INDUSTRY FACT FILE · GOVERNMENT, PSUS & PUBLIC DIGITAL SERVICES

Threat Landscape: Top Cyber Threats Facing Government, PSUs and Public Services

The 18 most relevant cyber threats, attacks and industry challenges for ministries, state governments, PSUs, data centres and government technology providers, and the impact each has on services, citizens and trust.

Government and public-sector undertakings attract every class of attacker because they hold what each one wants. Ransomware groups target hospitals, municipal portals and PSU IT systems because the pressure to restore public services is intense. State-linked actors pursue policy papers, defence and infrastructure information and the credentials of officials, usually through spear-phishing that imitates ministries and circulars. Hacktivists deface websites and flood portals with traffic during periods of tension. Fraudsters scrape citizen data and impersonate departments to run scams. Insiders hold privileged access to records that affect millions, and vendors and integrators often hold the keys to many departments at once.

The public record shows how these play out. Ransomware at AIIMS New Delhi in November 2022 encrypted five servers hosting the e-Hospital application; the government attributed the breach to improper network segmentation and restored data from an unaffected backup. The Nuclear Power Corporation of India confirmed in October 2019 that malware had been found on an internet-connected administrative computer at Kudankulam, which it said was isolated from the plant's critical network. Oil India reported ransomware at its Duliajan headquarters in April 2022 with a reported demand of about US$7.5 million; Madhya Pradesh's power management company reported ransomware on an internal IT system in May 2023; and a cyberattack in December 2023 corrupted data on the Madhya Pradesh e-Nagarpalika portal serving 413 towns, which officials restored from tape backups taken every three days. Across all sectors, CERT-In handled more than 29.44 lakh incidents in 2025.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by public-sector segment (Codec Networks assessment).

4.1 Ransomware on public-service systems

Ransomware is the threat most likely to stop a public service. Attackers enter through exposed remote desktop, unpatched VPN gateways or a phished account, move across flat networks, disable backups and encrypt servers in hours. The AIIMS New Delhi incident of 2022, where five servers were encrypted and the breach was attributed to improper network segmentation, and the corruption of Madhya Pradesh's e-Nagarpalika portal in 2023 show that recovery depends on segmentation and on backups that attackers cannot reach.

• Questions to test: Is every remote-access path protected by MFA and patched quickly? Are hospital, citizen-service and administrative zones segmented? Are backups offline and tested, and how long would restore take? Would the SOC see lateral movement and mass encryption early?
• Relevant services: infrastructure VAPT, segmentation review, backup and restore testing, EDR and managed SOC, ransomware response retainer and tabletop exercises.

4.2 Espionage through spear-phishing of officials

State-linked actors target ministries and strategic PSUs with emails that imitate circulars, meeting notices and official letters, often from lookalike domains, to plant backdoors or harvest email credentials. The Kudankulam malware discovery in 2019 began with an alert from CERT-In, a reminder that many intrusions are found by others first. Access is often held quietly for months while documents leave in small amounts.

• Questions to test: Are email authentication and lookalike-domain controls in place? Are attachments sandboxed and endpoints covered by EDR? Does anyone hunt for beaconing and slow exfiltration? Are officials trained and tested against realistic lures?
• Relevant services: email security review, phishing simulation for officials, EDR and SOC threat hunting, compromise assessment and forensics.

4.3 Citizen data exposure through portals and APIs

Citizen portals and APIs often check that a user is logged in but not whether the record requested belongs to that user. Changing an application or certificate number then returns someone else's data, and automated scraping can download entire databases. Under DPDP, State processing for services and benefits must follow the standards in the Rules, and exposed data fuels fraud calls in the government's name.

• Questions to test: Has every endpoint been tested for object-level authorisation? Are rate limits and bot detection in place? Was the latest release audited before hosting? Do we know what personal data each portal returns and why?
• Relevant services: application, mobile and API VAPT, pre-hosting audits and retests, DPDP data minimisation review and SOC monitoring of scraping.

4.4 Vendor and system integrator compromise

System integrators, developers and AMC providers often hold administrative access to many department systems, shared code libraries and deployment servers. One reused password or unprotected remote tool can open dozens of portals. CERT-In's 2023 guidelines for government entities address third-party access and outsourcing, and tenders increasingly require vendors to show security controls.

• Questions to test: Which vendors have privileged access, and is it time-bound and logged? Are vendor accounts protected by MFA? Are build and deployment systems secured and code integrity checked? Do contracts set audit, reporting and security duties?
• Relevant services: third-party risk assessments, privileged access review, secure SDLC and code review, vendor audits and SOC monitoring of administrative activity.

4.5 Detection, reporting and the 6-hour clock

CERT-In's Directions require government organisations to report incidents within six hours and keep 180 days of logs, and its 2023 guidelines expect a CISO with a dedicated security team. Many departments and smaller PSUs still have no round-the-clock monitoring, so defacements are found by citizens on social media and intrusions by CERT-In alerts.

• Questions to test: Are servers, portals, email, cloud and vendor sessions monitored 24x7? Are logs kept for 180 days in India? Is there a playbook covering containment, CERT-In reporting, public communication and DPDP intimation? Has it been rehearsed with senior officials?
• Relevant services: managed SOC, log architecture review, playbooks, cyber crisis management plans and tabletop exercises with officials.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation; CERT-In may issue directions and advisories.
• CERT-In guidelines for government entities: audit findings and incidents reviewed by the CISO and senior management; overdue audits become findings in themselves.
• NCIIPC: incidents on notified protected systems handled with NCIIPC guidance and reporting.
• DPDP: breaches of citizen or employee personal data trigger intimation to the Data Protection Board and affected persons once provisions commence in May 2027, subject to State-specific provisions.
• Legislatures and auditors: Parliament and assembly questions, CAG audit observations and vigilance enquiries follow major incidents.
• SEBI LODR (listed PSUs): cyber incidents disclosed in the quarterly corporate governance report.

• Could ransomware on one server stop our hospital, portal or treasury, and how long would recovery take?
• Has every citizen portal, app and API been audited since its last major change?
• Which vendors hold privileged access to our systems, and would we see them misused?
• Are our six-monthly internal and annual third-party audits up to date, with findings closed?
• Are backups offline, tested and separate from everyday administrator accounts?
• Could we detect, contain and report an incident within six hours, including at night and on holidays?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from official statements, replies in Parliament and widely reported events.