The Supreme Court of India on Thursday issued notices to the Union Government, the Central Bureau of Investigation, and the Punjab State Government on a petition seeking a federal probe into an alleged cyberattack targeting a health insurance claims processor.
A three-judge bench headed by Chief Justice of India Surya Kant, along with Justices Joymalya Bagchi and V Mohana, agreed to examine the plea filed by Mohali-based Vitraya Technologies Pvt Ltd. Senior advocate K Parameshwar, representing the company, informed the court that internal forensic analyses had successfully traced the origin of the breach and identified the entities responsible.
The claims processing firm manages sensitive personal and health records, including Aadhaar details, PAN numbers, and medical histories. According to the petition, the company detected a coordinated digital intrusion in February 2025 that involved brute-force login attempts, unauthorized server access, and the mass extraction of confidential customer data.
Competitor Involvement and Police Inaction
Technical investigations conducted by the company linked suspicious IP addresses, server logs, and automated login attempts to corporate competitors owned by an overseas fund and associated entities.
Despite submitting a detailed complaint accompanied by digital evidence, IP tracking data, and specific names to law enforcement on March 5, 2025, police failed to register a case for almost six months.
The Punjab State Cyber Crime Police Station in S.A.S. Nagar eventually registered FIR No. 16 of 2025 on August 29, 2025, invoking Sections 66 and 66(B) of the Information Technology Act, 2000. However, the petition contended that the case was registered in a mechanical manner against unidentified individuals, ignoring the specific names and technical evidence provided by the firm.
Concerns Over Data Protection
The petitioner further asserted that local police conducted no meaningful investigation, omitting essential procedures such as custodial interrogation, digital evidence preservation, or the seizure of server infrastructure.
Highlighting the wider implications of the breach, the company stated that the compromised data affects citizens across the country, raising grave concerns regarding the fairness, competence, and impartiality of the ongoing local investigation.
