https://cybershitty.com/ CyberShitty.com tracks the breaches, fraud waves, ransomware crews and exploited vulnerabilities hitting India — and the global threats Indian teams need to know — with every claim linked to its source. en-in Mon, 28 Sep 2026 18:30:00 GMT https://cybershitty.com/post/aadhaar-pan-leak-what-to-do https://cybershitty.com/post/aadhaar-pan-leak-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats You cannot change a leaked Aadhaar or PAN, but you can limit how it is used. Check your authentication history, lock your biometrics, share only masked Aadhaar or a VID, and watch your credit reports and AIS for anything you don't recognise. https://cybershitty.com/post/bank-account-frozen-by-cyber-police-what-to-do https://cybershitty.com/post/bank-account-frozen-by-cyber-police-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats Innocent people get caught when scam money passes through their account, often after a P2P crypto sale or a payment for work. How to find out who froze it, use the free grievance route, and cite High Court rulings against blanket freezes. https://cybershitty.com/post/cyber-fraud-money-recovery-guide-and-recovery-scams https://cybershitty.com/post/cyber-fraud-money-recovery-guide-and-recovery-scams Mon, 28 Sep 2026 18:30:00 GMT Threats Only police, banks, regulators and courts can return scammed money. The honest odds from official figures, RBI's liability rules and the 2027 compensation scheme, the free Ombudsman route, and how to spot fake recovery agents. https://cybershitty.com/post/deepfake-investment-ads-india-how-to-spot https://cybershitty.com/post/deepfake-investment-ads-india-how-to-spot Mon, 28 Sep 2026 18:30:00 GMT Threats AI-altered videos of ministers and the RBI Governor keep turning up in ads promising daily returns. None of them endorsed anything. Here is how the ads work, what the February 2026 IT Rules change, and what to do. https://cybershitty.com/post/digital-arrest-scam-what-to-do https://cybershitty.com/post/digital-arrest-scam-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats No Indian agency questions or arrests anyone over a video call. Here is how the fake CBI, police and TRAI script works, how to leave the call safely, and where to report it: 1930, cybercrime.gov.in and Sanchar Saathi's Chakshu. https://cybershitty.com/post/esim-swap-fraud-india-what-to-do https://cybershitty.com/post/esim-swap-fraud-india-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats A caller offers to 'upgrade' you to an eSIM or 'reverify' KYC. Minutes later your number works on someone else's phone and your OTPs go with it. How to spot it, what to do in the first hour, and how to prevent it. https://cybershitty.com/post/festive-sale-scams-india-how-to-shop-safely https://cybershitty.com/post/festive-sale-scams-india-how-to-shop-safely Mon, 28 Sep 2026 18:30:00 GMT Threats Big sales bring lookalike websites, 'spin the wheel' links, fake courier SMS and refund cons. Shop only inside the official app, never share an OTP or UPI PIN, and know when to call 1930 and when to call 1915. https://cybershitty.com/post/india-cert-in-dpdp-breach-reporting-explained https://cybershitty.com/post/india-cert-in-dpdp-breach-reporting-explained Mon, 28 Sep 2026 18:30:00 GMT Policy India has two breach-reporting regimes: CERT-In's six-hour rule, in force since 2022, and DPDP breach notice to a new Data Protection Board and affected people, which starts in May 2027. https://cybershitty.com/post/infostealer-infection-what-to-do https://cybershitty.com/post/infostealer-infection-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats Infostealers take saved passwords, session cookies and crypto wallet data in one sweep. Changing passwords on an infected machine is not enough: clean the device first, then rotate credentials and kill sessions from a clean one. https://cybershitty.com/post/is-this-a-scam-how-to-check-number-link-app https://cybershitty.com/post/is-this-a-scam-how-to-check-number-link-app Mon, 28 Sep 2026 18:30:00 GMT Threats Official tools can check most of what scammers send you: a caller, a website, an app, an adviser or a payee. Here is which check fits which situation, and what none of them can prove. https://cybershitty.com/post/loan-app-harassment-what-to-do https://cybershitty.com/post/loan-app-harassment-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats Check any lending app against RBI's directory before you borrow. If recovery agents are threatening you or your contacts, do not pay unknown UPI IDs. Keep the evidence and report on 1930, cybercrime.gov.in, Sachet and to the police. https://cybershitty.com/post/money-on-hold-after-1930-complaint-how-to-get-it-back https://cybershitty.com/post/money-on-hold-after-1930-complaint-how-to-get-it-back Mon, 28 Sep 2026 18:30:00 GMT Threats A hold stops your money moving. It does not return it. How to use the Home Ministry's Money Restoration Module, when you need an FIR or a court order under Section 503 BNSS, how Lok Adalats are used, and what documents to keep ready. https://cybershitty.com/post/mule-accounts-india-renting-bank-account-crime https://cybershitty.com/post/mule-accounts-india-renting-bank-account-crime Mon, 28 Sep 2026 18:30:00 GMT Threats Recruiters offer students and job seekers a commission to "use" their bank account. The Suspect Registry has flagged 32.08 lakh Layer-1 mule accounts, and police are arresting account holders. How the racket works, and what to do if you are already in it. https://cybershitty.com/post/ncrp-complaint-status-meaning https://cybershitty.com/post/ncrp-complaint-status-meaning Mon, 28 Sep 2026 18:30:00 GMT Threats Your acknowledgement number is the key to your complaint. Here is how to track it on cybercrime.gov.in, what happens behind the status screen, what the labels do and don't tell you, and how to escalate when nothing moves. https://cybershitty.com/post/ransomware-roundup-august-2026 https://cybershitty.com/post/ransomware-roundup-august-2026 Mon, 28 Sep 2026 18:30:00 GMT Threats Trackers counted between 997 and 1,168 claimed victims in August, a 2026 high, with Qilin and The Gentlemen far ahead. Only a small share of those claims had been confirmed by victims. https://cybershitty.com/post/scam-compounds-fake-job-offers-indians-trafficked https://cybershitty.com/post/scam-compounds-fake-job-offers-indians-trafficked Mon, 28 Sep 2026 18:30:00 GMT Threats Recruiters promise IT, sales or support jobs in Thailand, then move people across the border into scam compounds in Myanmar, Cambodia and Laos. What the numbers show, and how families can check offers and get help. https://cybershitty.com/post/sextortion-video-call-what-to-do https://cybershitty.com/post/sextortion-video-call-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats Sextortion is a crime and you are its victim. Don't pay, stop replying, save the evidence, report on cybercrime.gov.in or 1930, and use the two-hour takedown rule to get intimate content removed. https://cybershitty.com/post/shinyhunters-extortion-email-what-to-do https://cybershitty.com/post/shinyhunters-extortion-email-what-to-do Mon, 28 Sep 2026 18:30:00 GMT Threats Emails signed "ShinyHunters" range from real corporate data-theft extortion to copycat sextortion scams built on leaked addresses. Here is how to tell them apart, why you should not pay, and where to report. https://cybershitty.com/post/stock-market-whatsapp-group-scam-how-to-check https://cybershitty.com/post/stock-market-whatsapp-group-scam-how-to-check Mon, 28 Sep 2026 18:30:00 GMT Threats Fake 'VIP' and 'institutional account' groups are behind most of the money Indians lose to cyber fraud. Check SEBI registration, the broker's app and the payee's UPI ID before you invest anything. https://cybershitty.com/post/upi-fraud-what-to-do-1930 https://cybershitty.com/post/upi-fraud-what-to-do-1930 Mon, 28 Sep 2026 18:30:00 GMT Threats Speed decides whether scammed money can be frozen. Call 1930, report on cybercrime.gov.in, alert your bank within RBI's reporting windows, block your UPI and cards, and get an FIR on record. https://cybershitty.com/post/what-to-do-after-a-data-breach-notice https://cybershitty.com/post/what-to-do-after-a-data-breach-notice Mon, 28 Sep 2026 18:30:00 GMT Threats A breach letter or email is a prompt to act, not panic. Confirm it is genuine, work out what was exposed, and take the matching steps, from password changes to a credit freeze, while watching for the scams that follow. https://cybershitty.com/post/cbi-operation-chakra-vi-digital-arrest-mule-networks https://cybershitty.com/post/cbi-operation-chakra-vi-digital-arrest-mule-networks Sat, 26 Sep 2026 18:30:00 GMT Law enforcement Since June 2026 the CBI has raided scores of locations in more than 20 states, going after the account holders, shell firms and APK operators who launder digital arrest money. On 27 September it said 17 people were arrested in 30 days. https://cybershitty.com/post/citrix-netscaler-zero-days-exploited https://cybershitty.com/post/citrix-netscaler-zero-days-exploited Sat, 26 Sep 2026 18:30:00 GMT Advisory Citrix has fixed eight NetScaler ADC and Gateway flaws, two of them critical remote code execution bugs exploited for weeks before patches existed. CISA and CERT-In say they are under active attack; check for compromise before you patch. https://cybershitty.com/post/digital-arrest-scams-india-2026-figures-supreme-court-cbi https://cybershitty.com/post/digital-arrest-scams-india-2026-figures-supreme-court-cbi Sat, 26 Sep 2026 18:30:00 GMT Threats Official data put to the Supreme Court show digital arrest complaints on the national portal falling since 2024. The court has ordered new safeguards on mule accounts, the CBI is raiding networks and the Centre is pressing WhatsApp. https://cybershitty.com/post/india-sim-binding-imei-sanchar-saathi-telecom-fraud-rules-2026 https://cybershitty.com/post/india-sim-binding-imei-sanchar-saathi-telecom-fraud-rules-2026 Tue, 22 Sep 2026 18:30:00 GMT Policy Messaging apps have until 31 December 2026 to tie accounts to an active SIM. The fixed six-hour web logout has been dropped. DoT is warning that tampering with IMEIs or renting out SIMs can mean three years in jail. https://cybershitty.com/post/adapthealth-breach-4-1-million-patients https://cybershitty.com/post/adapthealth-breach-4-1-million-patients Tue, 08 Sep 2026 18:30:00 GMT Data theft The US home medical equipment provider told federal health regulators that 4,115,802 people had data exfiltrated after an attacker socially engineered access through a third-party contractor. https://cybershitty.com/post/boston-scientific-cyberattack-guidance https://cybershitty.com/post/boston-scientific-cyberattack-guidance Mon, 07 Sep 2026 18:30:00 GMT Incident The medical device maker says CrowdStrike's final investigation found the attacker entered through an external-facing network device, with no evidence that customer or patient data was accessed or taken. It has already warned the attack will hit 2026 results. https://cybershitty.com/post/atf-major-incident-qilin-calea https://cybershitty.com/post/atf-major-incident-qilin-calea Mon, 31 Aug 2026 18:30:00 GMT Data theft The Justice Department designated the incident a 'major incident'. Qilin briefly published about 6.3GB of alleged ATF files, which the agency says it cannot authenticate. https://cybershitty.com/post/ceva-logistics-cyberattack-european-warehouses https://cybershitty.com/post/ceva-logistics-cyberattack-european-warehouses Tue, 11 Aug 2026 18:30:00 GMT Incident A cyberattack on the logistics firm's European contract logistics operations delayed deliveries and exposed shipping details held for clients including Bol, De Bijenkorf, ING and Valve; twelve organisations have reported to the Dutch regulator. https://cybershitty.com/post/india-cybercrime-numbers-2025-2026-ncrp-cfcfrms-rbi https://cybershitty.com/post/india-cybercrime-numbers-2025-2026-ncrp-cfcfrms-rbi Tue, 04 Aug 2026 18:30:00 GMT Policy Complaints to the national cybercrime portal keep rising, reported losses were about ₹22,500 crore in 2025, and the 1930 system has saved more than ₹11,000 crore. The RBI's bank-fraud tables tell a different, narrower story. https://cybershitty.com/post/tata-electronics-cyber-incident-world-leaks-claims https://cybershitty.com/post/tata-electronics-cyber-incident-world-leaks-claims Mon, 03 Aug 2026 18:30:00 GMT Data theft The Apple supplier confirmed a cyber incident after the World Leaks extortion group posted what it says is 630GB of company data. The government says nothing critical was lost; Tata has not said whether data was stolen. https://cybershitty.com/post/bank-of-baroda-cyber-incident-data-leak-claims https://cybershitty.com/post/bank-of-baroda-cyber-incident-data-leak-claims Mon, 27 Jul 2026 18:30:00 GMT Incident The state-owned lender told stock exchanges it is investigating a possible business email compromise after an anonymous claim of data access. Claims that about 1TB of bank files were taken remain unverified. https://cybershitty.com/post/bajaj-auto-ransomware-attack https://cybershitty.com/post/bajaj-auto-ransomware-attack Mon, 20 Jul 2026 18:30:00 GMT Incident The two- and three-wheeler maker reported a ransomware attack on itself and a tech subsidiary on the day it happened. It later told analysts it suspended operations for a few days as a precaution, denting quarterly output. https://cybershitty.com/post/kratos-sneakylog-phishing-kit-dismantled-bka https://cybershitty.com/post/kratos-sneakylog-phishing-kit-dismantled-bka Sun, 19 Jul 2026 18:30:00 GMT Law enforcement The BKA and Frankfurt's ZIT cybercrime prosecutors, working with US partners, took more than 200 Kratos servers offline. Indonesian authorities arrested the kit's alleged developer and administrator. https://cybershitty.com/post/reliance-infrastructure-kudankulam-data-breach https://cybershitty.com/post/reliance-infrastructure-kudankulam-data-breach Sun, 19 Jul 2026 18:30:00 GMT Data theft Files tied to the Kudankulam nuclear project surfaced on the World Leaks extortion site after a breach of a Reliance Infrastructure server hosted by Yotta. NPCIL says they cover only conventional plant facilities, not nuclear safety or security. https://cybershitty.com/post/aa26-194a-fsb-center-16-router-snmp-advisory https://cybershitty.com/post/aa26-194a-fsb-center-16-router-snmp-advisory Sun, 12 Jul 2026 18:30:00 GMT Advisory Joint advisory AA26-194A says Russia's FSB Center 16 abuses default SNMP settings and known Cisco flaws to copy router configurations, and urges operators to harden, patch or replace network devices. https://cybershitty.com/post/operation-endgame-june-2026-socgholish-stealc-amadey https://cybershitty.com/post/operation-endgame-june-2026-socgholish-stealc-amadey Tue, 23 Jun 2026 18:30:00 GMT Law enforcement A 15-19 June 2026 action week coordinated by Europol and Eurojust disrupted three malware families that feed ransomware and fraud, recovering about 27 million stolen credentials and securing over EUR 41 million in crypto.