Star Health Data Breach | Supreme Court Urges Insurer To Explore Amicable Resolution With Cybersecurity Expert

The Supreme Court on Friday asked Star Health and Allied Insurance Company to explore settling its dispute with cybersecurity expert Himanshu Pathak over alleged vulnerabilities in the insurer's systems.

The direction came while the court was hearing Pathak's challenge to a Madras High Court judgment dismissing his writ appeals.

A bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana indicated that it would prefer the parties to bring the litigation to a close rather than continue with the proceedings.

Without expressing any view on the merits of the dispute, the bench remarked,

"The ultimate end of the day, no harm has been caused to you. Maybe that this information, and the anxiety to make money out of that information, has really put you on the right track, and you became wiser than what you have been in the past."

The bench then asked Star Health's counsel to consider settling the matter.

"Take instructions whether you can put a quietus to it, so that there can be a closure."

Appearing for Star Health, Senior Advocate Krishna Srinivasan said the company would be agreeable to safeguards ensuring that Pathak had no future involvement with its data.

"I do not want him coming in some other name. He will not be a part of any process in sharing data or otherwise."

Senior Advocate Prashant Bhushan appeared for Pathak.

Background

The appeal has been filed by cybersecurity expert Himanshu Pathak, proprietor of CyberX9, against the Madras High Court's judgment dismissing his writ appeals seeking directions against Star Health and Allied Insurance Company over alleged cybersecurity vulnerabilities that put customers' personal data at risk.

It stems from Pathak's claim that while accessing his insurance policy, he discovered vulnerabilities that could allegedly expose the personal data of other policyholders. After informing the insurer, civil and criminal proceedings were initiated against him over allegations of unauthorized access to the company's systems.

His writ petitions seeking action were dismissed by a Single Judge on October 23, 2024 who held that the dispute over the alleged data breach and vulnerabilities was already sub judice in pending civil proceedings and granted him liberty to pursue remedies after the suit's conclusion.

Dismissing the intra court appeals, the Division Bench of Chief Justice Sushrut Arvind Dharmadhikari and Justice G. Arul Murugan noted that the appellant had neither established any breach of his own personal data nor infringement of any personal right.

The High Court also held that Computer Emergency Response Team In and other authorities had already been informed of the incident and that the insurer had taken corrective measures.