Indian Businesses: Don't Click That 'Sorry' Email! 44K Systems Hit by Ransomware In Just 3 Days

Large-Scale Ransomware Campaign Targets Indian Businesses via "Sorry" Email Scam

A fast-spreading ransomware campaign is exploiting a deceptively simple tactic to infiltrate organizations across India. Cybercriminals are distributing malware through emails with the subject line "Sorry," tricking employees into opening attachments that grant hackers immediate access to corporate systems. Within seconds, the ransomware encrypts critical data and demands Bitcoin payments for decryption.

Over the past three days, the attack has compromised nearly 44,000 IP addresses and control panels, making it one of the most significant ransomware threats in recent months. The campaign primarily targets large companies, financial institutions, and businesses using corporate email accounts, where a single breach can expose entire networks.

How the Attack Unfolds

1. An employee receives an email with the subject "Sorry" from a seemingly legitimate sender.
2. Opening the email or downloading its attachment silently installs ransomware.
3. The malware rapidly encrypts files, locks system access, and displays a ransom demand in Bitcoin.
4. The infection spreads across connected systems, crippling operations by blocking access to customer databases, financial records, payroll systems, and critical business data.

Impact and Risks

Ransomware attacks can paralyze businesses for weeks, with recovery efforts often complicated by faulty decryption keys even if victims pay. Authorities warn that paying ransoms does not guarantee data restoration and may mark organizations for future attacks.

Cybersecurity experts emphasize that the campaign relies on social engineering rather than technical exploits, making employee awareness a critical defense. The rapid spread affecting thousands of systems in just days highlights the urgency for organizations to verify suspicious emails, update security protocols, and maintain offline backups.

Source: https://www.vibesofindia.com/sorry-email-ransomware-attack-44000-systems-india/

Indian Businesses TPRM report: https://www.rankiteo.com/company/indian-country-today

"id": "ind1783052763",
"linkid": "indian-country-today",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'India', 'type': 'Large Companies'},
                       {'industry': 'Finance',
                        'location': 'India',
                        'type': 'Financial Institutions'},
                       {'location': 'India',
                        'type': 'Businesses using corporate email accounts'}],
 'attack_vector': 'Phishing Email',
 'data_breach': {'data_encryption': 'Yes (Ransomware Encryption)',
                 'personally_identifiable_information': 'Likely '
                                                        '(Customer/Payroll '
                                                        'Data)',
                 'sensitivity_of_data': 'High (Personally Identifiable '
                                        'Information, Financial Data)',
                 'type_of_data_compromised': 'Customer databases, financial '
                                             'records, payroll systems, and '
                                             'critical business data'},
 'description': 'A fast-spreading ransomware campaign is exploiting a '
                'deceptively simple tactic to infiltrate organizations across '
                'India. Cybercriminals are distributing malware through emails '
                "with the subject line 'Sorry,' tricking employees into "
                'opening attachments that grant hackers immediate access to '
                'corporate systems. Within seconds, the ransomware encrypts '
                'critical data and demands Bitcoin payments for decryption. '
                'Over the past three days, the attack has compromised nearly '
                '44,000 IP addresses and control panels, making it one of the '
                'most significant ransomware threats in recent months. The '
                'campaign primarily targets large companies, financial '
                'institutions, and businesses using corporate email accounts, '
                'where a single breach can expose entire networks.',
 'impact': {'data_compromised': 'Customer databases, financial records, '
                                'payroll systems, and critical business data',
            'downtime': 'Weeks (potential)',
            'operational_impact': 'Paralyzed business operations, blocked '
                                  'system access',
            'systems_affected': '44,000 IP addresses and control panels'},
 'initial_access_broker': {'entry_point': "Phishing Email ('Sorry' Subject "
                                          'Line)'},
 'lessons_learned': 'The campaign relies on social engineering rather than '
                    'technical exploits, making employee awareness a critical '
                    'defense. Organizations should verify suspicious emails, '
                    'update security protocols, and maintain offline backups.',
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'root_causes': 'Social engineering (employee '
                                           'interaction with phishing email)'},
 'ransomware': {'data_encryption': 'Yes', 'ransom_demanded': 'Bitcoin'},
 'recommendations': ['Verify suspicious emails',
                     'Update security protocols',
                     'Maintain offline backups',
                     'Enhance employee awareness training'],
 'title': 'Large-Scale Ransomware Campaign Targets Indian Businesses via '
          "'Sorry' Email Scam",
 'type': 'Ransomware',
 'vulnerability_exploited': 'Social Engineering (Employee Interaction)'}