Home › Legal games › Six Hours
Cyber, IP & Data PrivacyFree after sign-up
Six Hours: Ransomware and CERT-In six-hour reporting
At 9:00 a.m. on 3 Feb 2026, ransomware encrypted MediQuick’s appointment server, which holds patient names, phone numbers and diagnoses. The IT team noticed at 4:00 p.m. The attacker demands payment in cryptocurrency. The CEO calls you at 7:30 p.m.
Client: MediQuick Clinics Pvt Ltd (chain of 12 clinics) · As on: 3 Feb 2026, 7:30 p.m.
What you will learn
Governing law
- Information Technology Act, 2000 — CERT-In powers, data protection liability and cyber offences.
Key provisions
- s.70B(6): CERT-In’s power to call for information and issue directions (six-hour reporting)
- s.43A: Compensation for failure to protect sensitive personal data
- s.66: Computer-related offences, for a complaint against the attacker
The six rooms
- The Mystery — sort 7 statements into facts that matter and distractions, then name the legal issue.
- The Evidence Vault — match 5 items of evidence to the facts and build a verified chronology.
- The Statute Library — choose the governing Act from 5 and the sections that decide the case.
- Decode the Section — sort clauses of CERT-In Directions of 28 April 2022 under s.70B(6); IT Act, 2000, ss.43A and 70B(7) and apply them to the facts.
- The Decision Chamber — pick the right next step and justify it.
- The Final Submission — complete the evidence checklist, deadlines and open questions.
Ready to open the first door?
Sign up free and play Six Hours in your browser.
Fictional learning scenario. Names, facts and dates are invented; statutory references are summarised and must be verified before use.