The Supreme Court (SC) on Thursday agreed to examine a plea seeking a Central Bureau of Investigation (CBI) probe into the alleged hacking and theft of personal and medical data of more than 1.5 lakh citizens stored by a technology company.
“We understand the seriousness…that is why in the other case, we have requested the learned solicitor general (Tushar Mehta) to consider if the law should be made more stringent,” a bench comprising Chief Justice of India Surya Kant and justices Joymalya Bagchi and V Mohana observed while issuing notice on a petition filed by Vitraya Technologies Pvt Ltd.
The petition, filed under Article 32 of the Constitution, alleged a large-scale cyber intrusion involving unauthorised access to highly sensitive personal information, including medical records, insurance claim details, Aadhaar-linked information, and other personally identifiable data. It contended that the breach has grave implications for citizens’ fundamental right to privacy under Article 21.
Appearing for the petitioner, senior counsel K Parameshwar and advocate Nupur Sharma submitted that the alleged data breach spanned six states and accused the investigating authorities of failing to conduct a meaningful probe despite repeated complaints.
“I have been informing the authorities from day one. I filed my complaint in March 2025. It took them till August 2025 even to register an FIR,” Parameshwar told the court, adding that the police invoked only Sections 66 and 66B of the Information Technology Act (less stringent provisions) despite the scale of the alleged offence.
{{/usCountry}}“I have been informing the authorities from day one. I filed my complaint in March 2025. It took them till August 2025 even to register an FIR,” Parameshwar told the court, adding that the police invoked only Sections 66 and 66B of the Information Technology Act (less stringent provisions) despite the scale of the alleged offence.
{{/usCountry}}“I gave them the details of the Singapore server where the medical records of nearly 1.5 lakh Indian citizens have gone. Even today, the FIR is against unknown persons. How do I trust this investigation?” argued Parameshwar, seeking the transfer of the investigation to the CBI or, alternatively, the constitution of a court-monitored special investigation team (SIT).
The bench issued notice on the plea.
According to the petition filed through advocate Abhinav Agrawal, Vitraya Technologies, which operates a digital platform for real-time settlement of health insurance claims, detected a coordinated cyber attack in February 2025 involving brute-force login attempts, mass downloading of confidential records, and extraction of sensitive customer data from its digital infrastructure.
Following an internal forensic examination, the company claimed to have identified suspicious IP addresses, server activities, and digital footprints allegedly linked to entities including Remedinet Technologies Pvt Ltd and IHX Pvt Ltd, both stated to be owned by foreign investment firm Bessemer Venture Partners. The petition further alleged that Bessemer coordinated the attacks with Medi Assist, Perfios Software Solutions Pvt Ltd, and other associated entities, all of whom are competitors of the petitioner.
Also read: India’s data breach bill hits all-time high as AI attacks take over: IBM report
The company said it approached the Punjab cybercrime police on March 5, 2025, furnishing technical logs, server data, IP details, names of the persons allegedly involved, and other documentary material. However, despite repeated representations and full cooperation during the preliminary inquiry, the police allegedly delayed the registration of an FIR for nearly six months.
When an FIR was eventually registered on August 29, 2025, at the Punjab State Cyber Crime Police Station in SAS Nagar, it was only under Sections 66 and 66B of the Information Technology Act and against “unknown persons”, despite the petitioner claiming to have supplied detailed technical evidence identifying those responsible.
The petition contended that the investigation has remained largely ineffective, alleging that no substantial forensic examination, seizure of digital infrastructure, preservation of electronic evidence, or custodial interrogation has been carried out despite the nationwide ramifications of the alleged breach.
It argued that the matter transcends an ordinary commercial dispute as it concerns citizens’ informational privacy, digital autonomy, and confidential medical information — rights recognised as intrinsic to Article 21 by the Constitution Bench in the KS Puttaswamy judgment (2017).
Seeking the transfer of the investigation, the company submitted that the allegations involve multi-jurisdictional cybercrime, cross-border digital infrastructure, multiple corporate entities operating across states, and complex forensic issues requiring investigation by an independent and technically specialised agency such as the CBI, or a court-monitored SIT comprising the CBI, CERT-In, and other cybersecurity authorities.