Star Health Data Breach | Cybersecurity Expert Moves Supreme Court Against Madras HC Order Refusing Probe

A plea has been filed in the Supreme Court challenging the Madras High Court's dismissal of petitions seeking directions to MeitY, IRDAI and SEBI to take action against Star Health and Allied Insurance Company over alleged cybersecurity vulnerabilities that put customers' personal data at risk.

The appeal has been filed by cybersecurity expert Himanshu Pathak, proprietor of CyberX9, against the Madras High Court's judgment dismissing his writ appeals seeking such directions.

A bench of Chief Justice Surya Kant, Justices Joymalya Bagchi and V. Mohana will hear Pathak's special leave petition on July 24.

The litigation stems from Pathak's claim that while accessing his insurance policy, he discovered vulnerabilities that could allegedly expose the personal data of other policyholders. After informing the insurer, civil and criminal proceedings were initiated against him over allegations of unauthorized access to the company's systems.

His writ petitions seeking regulatory action were dismissed by a Single Judge on October 23, 2024 who held that the dispute over the alleged data breach and vulnerabilities was already sub judice in pending civil proceedings and granted him liberty to pursue remedies after the suit's conclusion.

Dismissing the intra court appeals, the Division Bench of Chief Justice Sushrut Arvind Dharmadhikari and Justice G. Arul Murugan noted that the appellant had neither established any breach of his own personal data nor infringement of any personal right.

"In the absence of any lapse or data breach by any one, the appellant himself, having committed an illegal access and data breach, had after his attempt and negotiation ended in failure and faced with the civil and criminal proceedings, had thought it fit to raise a complaint. When none of the personal right of the appellant is affected and his personal data has not been breached, the writ petitions filed itself is not maintainable.", the Court observed.

The High Court also held that Computer Emergency Response Team In and other authorities had already been informed of the incident and that the insurer had taken corrective measures.