Journalism of Courage
Data breach: Mohali insurer moves Supreme Court for CBI probe against rivals
The company said it had identified multiple suspicious IP addresses, activities, automated login attempts, and other digital footprints linked to its competitors.
The health insurer discovered unauthorised access, brute-force login attempts, mass downloading of confidential records, and extraction of sensitive customer data. (Representational image)
A Mohali health insurance firm has moved the Supreme Court seeking a CBI inquiry into the alleged hacking of its customers’ digital personal data by some of its competitors. It stated that the police registered an FIR against “unknown persons” after a six-month delay in a “mechanical” manner and have not undertaken any substantial investigation.
On Thursday, a three-judge bench presided over by Chief Justice of India Surya Kant issued notices to the central government, the Central Bureau of Investigation, and the Punjab government, seeking their response to the petition filed by Vitraya Technologies Pvt Ltd.
Appearing for the company, senior advocate K Parameshwar told the bench also comprising Justices Joymalya Bagchi and V Mohana that it had identified where the breach originated and who was responsible.
The petition said the company is engaged in health-insurance claim processing and stores highly sensitive and confidential digital information including customers’ medical records, insurance claim details, Aadhaar-linked information, and other personally identifiable data.
In February 2025, the company discovered what it described as a coordinated and sophisticated cyber intrusion involving unauthorised access, brute-force login attempts, mass downloading of confidential records, and extraction of sensitive customer data from its digital infrastructure.
The petition added that upon internal forensic examination and technical investigation, the company identified multiple suspicious IP addresses, server activity, automated login attempts, and other digital footprints linked to its competitors, which it said are owned by a foreign fund and associated individuals or entities.
FIR against ‘unknown persons’ after nearly six months
The petition said that although the company approached the police with a detailed complaint dated March 5, 2025, furnishing technical logs, server data, IP details, names of entities and people involved, and supporting documentary material, they “failed to register an FIR for nearly six months”.
Story continues below this ad
“Ultimately, FIR No. 16 of 2025 came to be registered on 29.08.2025 at Punjab State Cyber Crime Police Station, S.A.S. Nagar only under Sections 66 and 66(B) of the Information Technology Act, 2000, and that too against ‘unknown persons’, notwithstanding the detailed disclosures, identities, technical evidence, and statutory provisions repeatedly supplied by the petitioner. The FIR, therefore, came to be registered in a mechanical and diluted manner, not commensurate with the true nature, scale, and gravity of the offences,” the company said, seeking the top court’s intervention.
The petition stated that the police appeared not to have undertaken any substantial forensic investigation, custodial inquiry, seizure of digital infrastructure, preservation of electronic evidence, or meaningful investigative exercise in the case.
The petition said the matter has “nationwide implications concerning sensitive personal and medical data of citizens which includes their sensitive data such as Aadhaar card, PAN card, medical history, etc.” and “raised serious apprehensions regarding the fairness, impartiality, and efficacy of the investigation”.
© The Indian Express Pvt Ltd
Advertisement
Loading Recommendations...
Advertisement
Live Blog