Our website was hit by a DDoS attack, what legal steps can we take?

Question

Our company website/server went down due to what appears to be a deliberate denial-of-service attack, and we want to pursue this legally. I would like to understand which provision governs this, what it entitles me to, and how long I have before the remedy lapses. I also want to know whether I need a lawyer for this or can do it myself.

MyVakeel Legal Desk · Accepted Answer

In India, the answer to "Our website was hit by a DDoS attack, what legal steps can we take?" turns on Information Technology Act, 2000 – Section 43(f), Information Technology Act, 2000 – Section 66 and CERT-In Directions, 2022. The points below set out the position and then what to do about it, in the order it should be done.

Section 43(f) of the IT Act specifically covers denying access to an authorised person or disrupting a computer system, entitling the company to compensation for the loss, and Section 66 criminalises this conduct where done dishonestly with up to 3 years imprisonment.

Under the CERT-In Directions, 2022, a DDoS attack causing disruption must be reported to CERT-In within 6 hours of detection, which is mandatory for all service providers, intermediaries, and body corporates in India.

Preserve server logs, traffic analytics and firewall/CDN reports immediately, as tracing the source IPs is essential and logs are often auto-purged after a short retention window.

If the attack is traced to servers outside India, cross-border investigation typically requires the cyber cell to route requests through the CBI's Interpol wing or via Mutual Legal Assistance Treaty requests, which can take months.

You can simultaneously pursue a civil claim for the financial loss caused (lost sales, downtime cost) either before the adjudicating officer under Section 46 IT Act or through a civil suit, if the attacker is identified.

In practice, in this order: 1) Engage your hosting/CDN provider to mitigate the attack and preserve logs; 2) Report to CERT-In within 6 hours as mandated; 3) File a complaint at the cyber cell citing Section 43(f) and Section 66 IT Act; 4) Consult a lawyer for a civil compensation claim once evidence is secured.

Timing matters here: Information Technology Act, 2000 – Section 43(f) works on limitation periods, so a ddos attack claim that is right on the merits can still fail if it is brought late. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.