India's Central Bureau of Investigation searched 89 locations across 20 states in three digital arrest fraud cases and arrested three people accused of moving the stolen money, the agency said.

The searches were conducted under Operation Chakra-VI, the agency's ongoing cybercrime enforcement programme. All three cases were transferred to the CBI from state police forces.

In a digital arrest, fraudsters posing as police officers, courts or central agencies contact a victim by phone or video call, allege involvement in a crime, and hold the person under sustained psychological coercion — often forbidding contact with family — while extracting transfers described as bail, verification deposits or asset audits.

The three cases together account for about ₹42.4 crore (approx. US$4.49 million) in losses, an official press release stated. One, linked to the Birla Institute of Technology and Science, Pilani, involved a victim kept under digital arrest for three months and defrauded of ₹7.67 crore by callers impersonating police officers. The release does not specify the victim's role at the institution. A second case in Gujarat also ran three months and cost the victim ₹19.24 crore, again to scammers posing as police. The third, in Karnataka, involved a month of coercion and ₹15.45 crore.

Those durations are the notable detail. Where most online fraud is transactional, these cases show victims held in a controlled state for weeks or months, which is what allows losses to climb into crores from a single target.

The CBI said the searches were planned on the basis of financial and technical analysis, including examination of bank accounts and online account access records, and were carried out simultaneously to prevent destruction of evidence. Investigators seized banking documents, account records and digital devices, which the agency said are now undergoing forensic examination to map the financial and technological infrastructure supporting syndicates operating across state lines.

Also read: CBI Files Charges Against 13 in Digital Arrest Fraud Case Linked to Myanmar Cyber Slave Compounds

The three people arrested are described as beneficiaries in the laundering chain rather than the callers. Akash, a resident of Haryana, allegedly received ₹1.95 crore into an account he opened himself and pushed the funds onward to other accounts the same day. Raja Karmakar of Kolkata is accused of receiving ₹1.5 crore into his firm's account. Jyoti Rani allegedly received part of the proceeds, withdrew some in cash and transferred the rest onward. The agency said efforts continue to trace the remaining accused.

On Dec. 1, 2025, a Supreme Court bench of Chief Justice Surya Kant and Justice Joymalya Bagchi ordered a pan-India CBI investigation into digital arrest scams, specifically directing scrutiny of mule accounts and alleged collusion by bank officials, and requiring several states to grant the agency consent under the Delhi Special Police Establishment Act. In interim directions issued Aug. 5, 2026, the court told the Reserve Bank of India to publish a standard operating procedure for banks handling mule accounts, pressed states to notify cyber crime coordination centres, and ordered an inter-departmental committee to examine a shared-liability and victim compensation framework.

Home ministry figures cited before the court show digital arrest complaints falling from 123,672 in 2024 to 58,249 in 2025 and 16,377 through June 30, 2026, with ₹18.05 crore restored across 36,290 cases. The trend is fewer complaints but heavier individual losses.

The Cyber Express Weekly Roundup 

Microsoft Confirms Exploited Entra ID Flaw 

New Zealand Proposes Social Media Ban for Under-16s 

Cyble and DRONA Launch AI Cyber Defense Initiative in India 

AI Agents Could Create New Cybersecurity Risks 

Ledger Fixes Ethereum App Flaw Amid Disclosure Dispute 

Global Crackdown Nets 58 Arrests in West African Crime Networks 

Weekly Cybersecurity Takeaway 

The Cyber Express Weekly Roundup 

Qilin Dominated Ransomware Attacks in H1 2026 

Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms 

PNLD Data Breach Leaks Police and Government Contact Details 

De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns 

Updoc Data Breach Exposes Customer Contact Information 

Weekly Cybersecurity Takeaway 

The Cyber Express Weekly Roundup 

Four Men Admit to $2.2 Million Medicaid Fraud Scheme Using AI 

Tribeca Data Leak Exposes Celebrity-Linked Information 

Origin Energy Data Breach Impacts Around 900,000 Customers 

Joyfill npm Packages Found Distributing DEV#POPPER Malware 

Student Accused of IIT Website Breaches Offered Technical Assessment 

FBI Warns of PLC Cyberattacks Targeting U.S. Water Utilities 

Weekly Cybersecurity Takeaway

Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from Cyble Research and Intelligence Labs (CRIL). It's not just the highest total of any country tracked in the report — it's more than the next nine most-targeted countries combined.

Canada, in second place worldwide, recorded 179 attacks. Germany logged 155. The United Kingdom, 138. Add up the rest of the global top 10 — France, Italy, Spain, Thailand, India and Brazil — and the total still falls more than 600 attacks short of the U.S. figure alone. Out of 3,836 ransomware attacks CRIL tracked worldwide this half, roughly 45% landed on American soil.

Also read: Fairlife Ransomware Attack Hits Production Systems, U.S. Operations Suspended

A Single Region, an Outsized Share

Widen the lens slightly and the picture holds. North America as a whole recorded 1,981 ransomware attacks in H1 2026 — more than half of every ransomware incident Cyble observed globally — alongside 35 data breach and leak incidents and 9 initial access sale listings. The report describes the region as home to "a mature, persistently active RaaS ecosystem operating at high volume across a wide range of industries and geographies."

Two ransomware-as-a-service operators did much of the damage. Qilin, the single most prolific gang worldwide, claimed 370 of those North American attacks on its own — nearly 19% of the regional total. Akira followed with 268, and INC Ransom added another 164. Together, Qilin and Akira alone accounted for more than half of all recorded ransomware activity across the region, a level of concentration that points to a small number of highly organized affiliate networks doing the bulk of the damage rather than a diffuse swarm of opportunists.

Also read: Qilin Ransomware Group’s TTPs Examined by Researchers

Where the Pressure Lands

Professional Services bore the brunt of North American ransomware activity, with INC Ransom showing a marked preference for law firms and other high-value services with sensitive client data. Construction, Manufacturing and Healthcare followed close behind.

One operator, AiLock, stood out for a coordinated wave of victim disclosures that all landed on the same day — March 3 — a pattern consistent with a mass-exploitation campaign rather than isolated intrusions. LockBit, despite years of law enforcement pressure and takedown attempts, kept up a steady tempo against public-sector and educational targets throughout the period, showcasing how difficult the group has been to fully dismantle.

On the data breach side, Technology and financial services (BFSI) were the most frequently targeted sectors in North America, together accounting for roughly 43% of incidents — a reflection of how much intellectual property and monetizable personal data those industries hold.

Notably, Agriculture & Livestock emerged as a significant target for initial access brokers, accounting for a third of all access listings tied to the region. Cyble flags this as a sign of "growing risk in the food supply chain," an area that has historically drawn less attention from ransomware operators than finance or healthcare.

The initial access market itself was strikingly concentrated: two sellers, tracked under the handles "redpin" and "xpl0itrs," accounted for nearly all listings targeting North American organizations. Threat actors also continued to lean on known and zero-day vulnerabilities in widely deployed enterprise platforms — including products from Ivanti and Palo Alto Networks — as their preferred way into corporate networks.

Hacktivism Blurs into Cybercrime

North America wasn't spared the hacktivism wave sweeping the rest of the world either. Collectives including SOLDADOS DIGITALES – UNIÓN AMERICANA and LYSTIC TEAM #ID drove roughly 56 data leak or dump posts and touched about 360 unique domains across the region, with Government, Technology, financial services and telecommunications entities most frequently in the crosshairs.

Cyble's broader findings suggest many groups marketing themselves as ideologically driven hacktivists are, in practice, running side businesses in stolen data brokerage and DDoS-for-hire services — a blurring of motive that complicates how defenders triage the threat.

The scale of the U.S. numbers doesn't necessarily mean American companies have weaker defenses than their global peers — the concentration also reflects the sheer size and digital density of the U.S. economy, and its outsized share of the high-value targets ransomware affiliates chase. But the data does argue for a shift in posture.

Cyble's broader recommendations — treating data exfiltration, not just encryption, as the primary risk; prioritizing patches for the recurring vendor list; and monitoring initial access markets as a leading indicator rather than an afterthought — apply nowhere more urgently than in a country absorbing this much of the world's ransomware volume on its own.