Before there were frameworks, cyber cells, or people had even heard the word ‘cybercrime’ — there was Pattathil Dhanya Menon, already extracting data from corrupted floppy disks with nobody to ask for help. In 25 years as India’s first female cybercrime investigator, she has worked on cases of stalking, sextortion rings, organisational data heists, and investment scams that have gutted families whole. The founder of Avanti Cybersecurity Solutions Pvt Ltd has trained police forces, advised ministries, and run awareness sessions in schools across the country. She’ll tell you, without flinching, that we’re still losing the battle. On her recent visit to Hyderabad, CE sits down with her to understand the world that exists just beneath the screen — and why it should concern every single one of us.
Excerpts
What intrigued you to get into cybercrime and cybersecurity?
I can’t pretend I planned this career. It was more destiny than choice. I attended a seminar, wrote an exam, qualified, and my grandfather insisted that I study the subject. I was only 22 or 23, and there was nobody to guide me. I didn’t know what the future held or even what the industry would become. Looking back, I realise he understood far more than I did.
What was the biggest challenge you faced while breaking into this field?
Initially, it was my own ignorance and the absence of mentors. Every mistake had to be figured out alone. There was constant uncertainty because I only saw small pieces of larger cases and never knew where they fit. Financially, things were difficult. The government and its agencies were the primary clients, while peers in other fields seemed to be doing much better. I couldn’t explain my work to others, and I didn’t know where it would lead. Yet every day felt exciting, and by evening I felt I had done something worthwhile. I used to ask my grandfather, ‘When will I make money? When will I order something without checking the price?’ His answer was always the same: ‘One day I’ll be known as your grandfather.’
Could you recall the first cases that you were working on?
Initially, we only handled parts of cases. It often took six to eight months before I understood the bigger picture. Early work involved tracing mobiles, analysing call records and SMS messages, recovering deleted files from hard drives and memory cards, and extracting data from corrupted floppy disks and CDs. Today, one might not even remember what the floppy drives looked like. That’s where we started.
Which type of cybercrime is rising most alarmingly right now?
The volume has grown enormously. When I started, we handled around eight files a month. Today, my office receives at least 200 complaints a day. Of those, around 40–50 require serious attention. A few involve organisations — data theft, corrupted servers, altered databases, or ex-employees taking sensitive information. The number of such cases is lower, but the financial and reputational damage is huge. Most cases involve individuals. Relationship disputes, blackmail using intimate images, stalking, fake profiles, compromised WhatsApp and Telegram accounts, digital payment fraud, and investment scams are everyday occurrences. Stalking, in particular, is constant.
You work with organisations like the Ministry of Women and Child Development, police forces, and child helplines. Can you tell us about the collaborations?
In my early years, I helped set up cyber cells in different states and even worked with agencies in other countries. Cases came from police departments, courts, Home Departments, and ministries across India. Some states now have their own specialised departments, but I still receive consultancy assignments and court appointments. I work internationally with countries that have treaties with India.
You’ve also handled a lot of cases involving children and women, which you’ve described as disturbing. Can you tell us about that?
Anything involving children disturbs me. No child is born a criminal; society shapes them. We have moved from responsible parenting to child-pleasing parenting. Children are exposed to cyberspace too early and become deeply dependent on it. For 16 years, we have run cyber-awareness programmes in schools and through an online initiative for students from Classes 3 to 9. Yet many parents struggle to convince their children to participate. Children need discipline. Today, phones are used to make children eat, sleep, or stay quiet. That should not happen. If we establish healthy habits early, many problems can be prevented.
These days many people comment through fake IDs on social media. What is your take?
Many teenagers have multiple social media accounts — one for parents, one for gaming, another for exploring freely. We’ve reached a point where laws may have to restrict social media access for minors. Personally, I believe anonymous opinions carry little value. In a democracy, even voting requires verified identity. At the same time, there are laws against harassment, abuse, and privacy violations. Anyone who thinks a fake account guarantees anonymity is mistaken. Digital footprints remain, and people can be traced.
With all the complaints that come in, how do you prioritise?
If one person reports online abuse while another case involves a child being exploited through sextortion, the child’s case will take priority. Law enforcement faces similar challenges because resources are limited. The system has improved dramatically. 25 years ago, officers once collected computer monitors as evidence without bringing the CPUs. Today, most officers are trained and informed. Citizens also need to understand that digital actions have consequences. Data is not free simply because it feels accessible. Not everything should be downloaded, shared, or forwarded.
What are the most common cybercrime complaints you see from Hyderabad?
Investment scams and digital arrest are the most common. I’ve even received calls from people claiming to be police officers, saying I was under arrest for viewing illegal content. My response was simple: ‘Come and arrest me. I’ll speak to my lawyer.’ People panic during crises. But if an ambulance or fire brigade takes time to arrive, the police are not going to arrest you within minutes. Pause. Speak to a lawyer or someone you trust. Never share personal information, click suspicious links, download unknown files, or reveal sensitive details. Follow basic digital hygiene.
How active are Hyderabad’s cybercrime police stations in resolving these cases?
Most cybercrime police units across India are now highly updated and regularly bust scam networks. Every state has made significant progress.
People assume tech professionals are less likely to be victims. What would you say?
Everyone is a target. A young employee earning Rs 30,000 may be tempted by an offer promising Rs 75,000 almost immediately. Similarly, investment scams lure people with promises of unrealistic returns. We also see students abandoning studies because they believe cryptocurrency, gaming, or online schemes will make them rich. Some insist they have huge earnings. I tell them: ‘Buy me a cup of tea with that money, and I’ll believe it.’ Often, they can’t. If you can’t use the money in real life, what is it worth?
What would you recommend to Hyderabad’s government to strengthen cybersecurity?
Awareness is the key. Regardless of age, education, or background, we are all deeply immersed in cyberspace. Cyber awareness must begin in schools. Personally, I’m not in favour of banning social media for minors. However, after 25 years of seeing the worst consequences and repeatedly urging parents and stakeholders to monitor and guide children, I increasingly feel there may be no alternative. If society cannot regulate itself, governments may eventually have to step in. At one point, I conducted around 130 awareness sessions in a single year. I have spent years speaking publicly and advocating for digital responsibility. Yet many people still fail to understand the urgency. Somewhere, society has to draw a line — because the consequences affect everyone.
