Madras High Court Dismisses Plea Seeking Probe Into Data Breach At Star Health Insurance

Justice M Dhandapani dismissed the plea noting that a civil suit filed by the company against Pathak was already pending in which a single judge had already passed an interim injunction. Thus, noting that the issues were connected and there could not be parallel proceedings for the same issue, the court dismissed the plea. The court, however, gave liberty to Pathak to work out his remedy before the appropriate authority.

On October 9 this year, the Insurance Company admitted that it was a victim of a malicious cyber attack that resulted in unauthorized and illegal access to data.

Pathak had approached the court to direct the Ministry of Electronics and Information, Ministry of Finance, Ministry of Home Affairs, and Ministry of Corporate Affairs to take action based on his representation in which he had claimed that the company's security system had vulnerabilities and any person could access its data. While the petition was pending, Star Health became a victim of the cyber-attack.

When the matter was taken up on Wednesday, Pathak's counsel contended that the Hackers had claimed that they received the data from the officials of Star Health itself. He submitted that when he approached the Meity which was a body meant to deal with the issue, the Ministry informed him that they had asked Star to look into the issue. He added that a similar reply was received from IRDAI, which was also just sitting on the matter. He argued that it was surprising to see a criminal being asked to look into his own actions.

On behalf of the four Ministries, ASG ARL Sundaresan argued that the Ministry could not do anything in the issue as the appropriate authority was the IRDAI which was already taking necessary action under the Act. The ASG also informed the court that individual disputes were already pending before the petitioner and the company and Star had already filed a civil suit which was pending. In such a context, ASG argued that Pathak should have sought the remedy before the Civil court or the IRDAI which was the appropriate authority and instead he had approached the High Court. He thus sought to dismiss the plea.

On behalf of IRDAI, Advocate MB Raghavan submitted that it had already issued guidelines and even after filing of the petition, a detailed guideline was also issued. It was also submitted that periodical procedures were created for curbing the hackers and protecting data. Further Raghavan also informed that the authority could not act upon the complaint by the petitioner since a civil dispute was already pending.

Star Health, on the other hand, questioned Pathak's locus and argued that he himself was a hacker who entered into the companies data unauthorisedly. The company submitted that though Pathak portrayed himself as a crusader, he came into the system uninvited, hacked it and told the company that its data is vulnerable. The company added that since Pathak's actions could have penal consequences, a civil suit was filed by the company seeking injunction in which an interim injunction was also granted. The company, thus sought to dismiss the plea.

The court, after hearing all the parties thought it fit to dismiss the writ petition giving liberty to Pathak to work out his remedy before the appropriate authority.

Citation: 2024 LiveLaw (Mad) 398

Case Title: Himanshu Pathak v Ministry of Electronics and Information and Others

Case No: WP 12049 of 2023