Bombay High Court Restrains BlackShrantac, Unknown Parties From Leaking Adfactors Data

The Bombay High Court has granted urgent ad interim relief to Adfactors PR Private Ltd., restraining unknown parties, including the 'BlackShrantac' ransomware group, from using, copying, publishing, or leaking its internal data.

Justice Milind N. Jadhav held that Adfactors had made out a prima facie arguable case for protection of its confidential and commercially sensitive information.

The court observed that if the exfiltrated data, stated to be about 1 TB, were made public, leaked, or traded, it would lead to “disastrous and catastrophic consequences” for the firm and its clients, noting that the balance of convenience lay in favour of Adfactors.

The court was informed that Adfactors received an email on March 29, 2026 from the ransomware group claiming to have downloaded its internal data prior to encryption and threatening disclosure. While the subject line suggested publication within 24 hours, the contents indicated that the data would be released after the weekend.

Adfactors, a public relations firm handling sensitive client information across multiple sectors, submitted that it acts as a fiduciary custodian of confidential data and any unauthorised disclosure could result in significant financial loss, reputational harm, and future litigation.

Recording the submissions, the court noted that BlackShrantac, identified in September 2025, has targeted organisations across sectors using threats of public release of stolen data and that the material on record showed a clear threat perception of disclosure.

The court clarified that “data theft” is a misnomer in law and that such acts fall within the framework of data crimes under the Copyright Act, the Information Technology Act, and the Indian Penal Code, including in cases involving actors operating from outside India.

Taking note that the perpetrators were operating through anonymised channels and their identity remained unknown, the court held that there was a likelihood of dissemination or sale of the data causing grave prejudice to Adfactors and its clients.

“Further if threat perception of disclosure is exercised and implemented, it would amount to infringement of fundamental right to privacy covered under the expanded definition of Article 21 'Right to Life' under the Constitution of India,” the court said.

The court granted an ad interim injunction restraining unknown parties and all persons acting through them from using, copying, publishing, distributing, transmitting, or disclosing any internal data of Adfactors that is not in the public domain.

It also directed unknown parties to delete all such data from their computer systems and restrained them from disclosing or publicising the present suit.

The court granted Adfactors leave to implead the platform 'X' as a defendant.