← All common situations
Common situations
Your Computer, Email, or Social Media Account Was Hacked
Applies when a citizen's computer, email, social media, or other online account was accessed, damaged, or taken over without permission, or their data was stolen -- separate from cases where money was actually taken via financial fraud, or where a known person is stalking or harassing you.
Steps
1. Secure the account or device immediately
Change passwords, turn on two-factor authentication, log out of all other active sessions, and disconnect an infected device from the internet before doing anything else. Acting quickly can limit further damage even before any complaint is filed.
2. Preserve evidence before you act further
Screenshot login-alert emails, unusual account activity, and any ransom or threat messages, noting the exact date and time. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (successor to s.65B of the Evidence Act) requires a certificate for electronic evidence to be used later, so keep original files, not just screenshots.
3. Understand which provision actually applies
Section 43 of the IT Act, 2000 makes unauthorized access, data theft, virus introduction, or denial of access a civil wrong, with damages payable by way of compensation to the person affected -- the original Rs.1 crore ceiling on this compensation was removed by the IT (Amendment) Act, 2008, so no statutory cap currently applies. Section 66 makes the same acts a criminal offence -- up to 3 years' imprisonment and/or a fine up to Rs.5 lakh -- only when done dishonestly or fraudulently.
4. Check whether a more specific section fits your facts
If someone received or is using your stolen device, s.66B applies; if your password, digital signature, or a unique identifier was misused, s.66C (identity theft) applies; if someone used your credentials to cheat or deceive another person or platform, s.66D (cheating by personation) applies; if a private image was captured or shared without consent, s.66E (violation of privacy) applies.
5. Report on the National Cyber Crime Reporting Portal
File under the 'Other Cyber Crime' category at cybercrime.gov.in -- hacking and data theft are handled here, not through the 1930 helpline, which is reserved for financial fraud. You will need details of the compromised account, evidence of unauthorized access, and any suspect information you have.
6. File an FIR at any police station (Zero FIR)
Section 77B of the IT Act treats offences punishable with up to 3 years' imprisonment as cognizable, so s.66 offences are cognizable. You can walk into any police station regardless of where the hacking occurred and have it registered as a Zero FIR under Section 173(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023, later transferred to the right station.
7. Know what happens if the accused is arrested
The Supreme Court clarified in Maharaj Saran v. State of Punjab, 2026 SCC OnLine SC 1378 (16 July 2026), that a s.66 offence is bailable when Section 77B is read with it, since the maximum punishment is 3 years -- so bail is ordinarily available as a matter of right once the court grants it.
8. Consider a separate civil compensation claim
Independent of any criminal case, Section 46 of the IT Act lets you approach an Adjudicating Officer for compensation for loss or damage caused, for claims up to Rs.5 crore -- a route worth pursuing if your actual financial or data loss needs to be quantified and recovered.
9. Notify the platform or service provider directly
Report the compromise to the email provider, social media platform, or bank involved so they can lock the account, reverse unauthorized changes, or flag suspicious transactions -- this runs alongside, not instead of, your legal complaint.
National Cyber Crime Reporting Portal (Other Cyber Crime): https://cybercrime.gov.in
Helpline: 1930 covers financial fraud only -- for hacking, use the portal above or your local Cyber Cell.
Good to know
Handled by: State/UT Police Cyber Cell; Indian Cyber Crime Coordination Centre (I4C), MHA (portal); IT Act Adjudicating Officer (civil claims)
Who can use this: Anyone whose computer, email, social media, or other online account or device was accessed, damaged, or taken over without their permission, or whose personal data or identity was stolen via a computer resource.
This does not cover: Financial fraud where money, OTP, or UPI credentials were actually used to steal funds (see cyber_fraud_non_emergency); ongoing harassment or threats from a known person (see cyberstalking_harassment); already-published false or damaging content about you (see defamation_remedies). This route is for unauthorized access, hacking, or data/identity theft itself.
Time limit: No special limitation period applies to filing an FIR for this cognizable offence, but a civil compensation claim before the Adjudicating Officer should not be delayed -- digital evidence and logs can be lost or overwritten with time. (General principle; no specific limitation period is prescribed for s.66 or s.46 IT Act claims)
Cost: Filing an FIR and a National Cyber Crime Reporting Portal complaint are both free; Adjudicating Officer proceedings do not require a court fee either.
You'll need:- Which account/device was compromised and when you noticed it
- Evidence of unauthorized access (login alerts, altered settings, unfamiliar activity)
- Whether any data was copied, deleted, or published
- Whether any money or property was lost as a result
- Any suspect information you already have
Documents that help:- Screenshots of unauthorized login/activity alerts with visible timestamps
- Copies of the original vs. compromised data, where available
- Communications from the hacker, if any (ransom notes, threats)
- ID proof
- Device or account details (IMEI, email ID, username)
What happens after: Police register the FIR (or Zero FIR, if filed outside the local jurisdiction) and investigate; since the offence is bailable, the accused can seek bail as a matter of right if arrested. A parallel Adjudicating Officer complaint, if filed, proceeds as a separate civil inquiry with its own notice and hearing.
Legal remedies available
These are the remedies Indian law provides for this kind of situation -- not a recommendation, and not every remedy will apply to your own facts.
Criminal complaint / FIR under Section 66, IT Act
Jurisdictional police station or Zero FIR at any police station
The IT Act allows a criminal complaint under Section 66 where unauthorized access, data theft, or damage under Section 43 is shown to have been done dishonestly or fraudulently, with specific sub-sections (66B/66C/66D/66E) available where the facts fit identity theft, personation, or privacy violation.
Civil compensation claim under Section 46, IT Act
Adjudicating Officer appointed under Section 46
The Act permits a person suffering loss or damage from unauthorized access, virus introduction, or denial of access to seek compensation before an Adjudicating Officer, independent of any criminal proceeding, for claims up to Rs.5 crore.
Zero FIR at any police station
Any police station, transferred to the jurisdictional station
Section 173(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023 allows information about a cognizable offence, including hacking under Section 66, to be recorded at any police station irrespective of where it occurred.
Complaint to the National Cyber Crime Reporting Portal
Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs
The portal allows a structured online complaint under the 'Other Cyber Crime' category, generating a reference number and routing the complaint to the concerned state police for action.
Bail application, where the accused is arrested
Magistrate's court
Since Section 66 read with Section 77B of the IT Act treats the offence as bailable, an arrested person may apply for bail as a matter of right rather than requiring a discretionary grant.
Common questions
Is hacking into someone's account always a criminal offence?
Not automatically. Section 43 makes unauthorized access a civil wrong regardless of intent, with damages payable by way of compensation with no statutory ceiling (the original Rs.1 crore cap was removed by the IT (Amendment) Act, 2008). It becomes a criminal offence under Section 66, punishable with imprisonment, only when the act is done dishonestly or fraudulently.
Where do I report a hacked email or social media account?
File under 'Other Cyber Crime' on the National Cyber Crime Reporting Portal (cybercrime.gov.in), or approach your local police Cyber Cell directly. The 1930 helpline is reserved for financial fraud, not hacking alone.
Can I file a complaint even if the hacker is unknown to me?
Yes. A First Information Report can be registered against an unknown person, and the police can investigate to identify them using the evidence you provide.
What happened to Section 66A -- can it still be used against me?
No. Section 66A (offensive online messages) was struck down as unconstitutional by the Supreme Court in Shreya Singhal v. Union of India, (2015) 5 SCC 1, and cannot lawfully be invoked by anyone.
Is a hacking case bailable?
Yes, ordinarily. The Supreme Court has clarified (2026) that Section 66 read with Section 77B of the IT Act makes the offence bailable, since the maximum punishment is 3 years.
What if my stolen password was used to cheat someone else, not just me?
That may separately attract Section 66D (cheating by personation using a computer resource), which can apply whether you are the identity-theft victim or the person who was cheated using your stolen identity.
Do I need to file both a police complaint and a portal complaint?
They serve different purposes and can both be done. The portal complaint creates a timestamped record within the law-enforcement system, but registering an FIR (including a Zero FIR at any police station) is what formally starts a criminal investigation.
Can I claim money for the loss I suffered, separate from a criminal case?
Yes. Section 46 of the IT Act allows a separate civil claim before an Adjudicating Officer for compensation up to Rs.5 crore for loss or damage caused by unauthorized access under Section 43.
What if intimate images were captured or shared without my consent during the hack?
That specifically falls under Section 66E (violation of privacy), which separately punishes capturing, publishing, or transmitting images of a person's private area without consent.
Does it matter which state I am in?
No. The IT Act, 2000 is a central law applying uniformly across India, and BNSS's Zero FIR provision lets you file at any police station regardless of where the offence occurred.
Governing law: Information Technology Act, 2000, ss.43/46/66/66B/66C/66D/66E; BNSS 2023 s.173(1)
Source: Confirmed via bare IT Act text cross-checked against legal commentary; s.66A (Shreya Singhal v. Union of India, (2015) 5 SCC 1) is void and never cited as valid law; s.66's bailability confirmed via Maharaj Saran v. State of Punjab, 2026 SCC OnLine SC 1378 (16 July 2026). The original Rs.1 crore ceiling in Section 43 was removed by the IT (Amendment) Act, 2008 -- confirmed against a pre-2008 bare-act mirror showing the superseded cap, contrasted with the current, amended text.
Aadhrix does not decide which route applies to you. This describes the official process as published — consider an advocate for advice specific to your situation.
Dealing with this yourself?
Track it in your own Aadhrix -- keep the documents, dates, and follow-ups together in one place, free.
Track this in your own Aadhrix← Back to Aadhrix