The embodiments herein disclose a system and method for detecting a ransomware and preventing data breach. The method identifies whether a process for file access is initiated and executed by a user or by a malware program. The method uses keystrokes, mouse events along with OCR output extracted from recorded background screen image for checking if user has initiated the process. If a new process or file replication request is initiated automatically without any pattern in Key Strokes, Mouse Strokes and background screen, then the process is identified as a ransomware or data breach.