Delhi High Court Passes John Doe Order Against Extortion Threat Of Leaking Niva Bupa Insurance Company's Customer Data

The Court also directed social media intermediaries including Telegram to remove access to the unknown defendant's accounts and domain names, which are used to transmit the customers' confidential data.

Niva Bupa Health Insurance Company Ltd. (plaintiff) collects and stores sensitive personal data of its customers as a part of its business processes and statutory and regulatory obligations. It retains information including name, identity and address, policy copy, Unique Identification Number and other personal details of customers.

On November 28, 2024, Niva received an anonymous email from an unknown person (defendant no. 7). The emails stated that the defendant had acquired a large amount of its customer data and threatened to leak it if Niva did not agree to their demands.

The emails also contained samples of its customers' data. The unknown defendant asked Niva to contact via Telegram (defendant no. 1).

Niva stated that the unknown defendant breached its elaborate security measures and orchestrated a ransomware attack to extort money from it.

Niva relied on a similar case in the Bombay High Court in HDFC Life Insurance Company Ltd. vs. Meta Platforms Inc. & Ors. (2024), where the court passed a job doe order in a ransomware extortion threat against HDFC Life insurance company. The Court had directed social media intermediaries including WhatsApp and Telegram to remove access to the unknown defendant's accounts and domain names, which are used to transmit the customers' confidential data.

Niva also apprehended that the unknown defendant would likely use the data to impersonate it by infringing its trademark and passing off.

It relied on National Stock Exchange of India Ltd. vs. Meta Platforms, Inc. & Ors. (2024), where the Bombay High Court granted ad-interim relief to the National Stock Exchange of India, against infringing and passing off NSE's trademark in false and misleading advertisements on social media by unknown defendants. The Court had invoked the obligations of social media intermediaries the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules).

Considering the facts and circumstances of the case, Justice Manmeet Pritam Singh Arora opined that Niva made out a strong prima facie case for the grant of ad-interim relief.

It noted that disclosure of sensitive and confidential customer data could be damaging to HDFC and its customers.

It also noted that the customer data could be misused for a variety of purposes including for impersonating Niva, which would involve trademark infringement and passing off

The Court noted that the balance of convenience lies in favour of Niva and irreparable loss will be caused to it if the ad-interim relief is not granted.

The Court thus restrained the unknown defendant from using, copying, publishing, distributing, communicating or disclosing to any person the customer information.

The Court also directed the social media intermediaries including Telegram to remove, delete, block and disable accounts, content, domain names, phone numbers and email addresses associated with the unknown defendant.

It further directed them to disclose the available information of the unknown defendant including name, addresses, contact details, organization and associations and IP addresses.

Case title: Niva Bupa Health Insurance Company Ltd. vs. Telegram Fz-Llc & Ors.

Citation: 2024 LiveLaw (Del) 1342

Counsels for Plaintiff: Mr. Pradeep K. Bakshi, Sr. Adv. with Mr. Mohit Bakshi, Mr. Kushagra Pandit and Mr. Akshaja Singh.