NEW DELHI — The Supreme Court of India has issued a notice to the Union Government regarding a petition seeking an independent probe into an alleged cyberattack that exposed sensitive medical records of nearly 1.5 lakh Indian citizens. The petition calls for a Central Bureau of Investigation (CBI) inquiry into the breach, which spans six states and involves the potential transfer of private health data to overseas servers.
A Bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana issued the notice after hearing submissions from Senior Advocate K. Parameshwar, who appeared on behalf of the petitioner, health-tech company Vitraya Technologies Private Limited.
Background and Allegations
Vitraya Technologies operates a blockchain-backed platform designed for real-time settlement of health insurance claims. The platform serves major Indian health insurers, including Niva Bupa, Aditya Birla Health Insurance, and Star Health.
According to the petition filed under Article 32 of the Constitution, the company's IT infrastructure came under a severe cyber assault in February 2025. Vitraya’s internal cybersecurity team logged over 42,000 unauthorized login attempts within a 22-hour period. The breached data—containing personal health details and medical records of approximately 150,000 citizens—was subsequently routed to external servers hosted in Singapore.
The petitioner submitted that this cross-border transfer violates norms established by the Insurance Regulatory and Development Authority of India (IRDAI), which require domestic insurance and medical data to remain strictly within Indian territorial boundaries.
In its petition, Vitraya stated that digital forensic analysis traced the originating IP addresses to corporate entities operating within the health insurance claims processing domain, specifically pointing to Remedinet Technologies, IHX Private Limited, Medi Assist, and their common investor, Bessemer Venture Partners.
Concerns Over Local Law Enforcement Delay
A central argument raised before the top court was the inadequacy and delay in the local police investigation. Senior Advocate Parameshwar informed the bench that despite immediate formal complaints submitted to law enforcement agencies between March and July 2025, the Punjab State Cyber Crime Police Station took nearly six months to formally register a First Information Report (FIR).
When the FIR was eventually registered on August 29, 2025, it was filed against "unknown persons" and invoked only Section 66 of the Information Technology Act, 2000. Counsel argued that applying standard computer-related offense provisions to a complex, multi-state data theft rendered the local investigation ineffective, resulting in zero arrests and no significant progress over the subsequent months.
Given the multi-jurisdictional nature of the breach across six states and international data routing, the petitioner asserted that state-level cyber police lack the resources and legal jurisdiction to conduct an effective investigation.
Reliefs Sought and Court Observations
To protect digital evidence and ensure an unbiased investigation, the petitioner urged the Supreme Court to transfer the case from the state cyber police to the CBI. Alternatively, the plea requested the creation of a Special Investigation Team (SIT) combining representatives from the CBI, the Indian Computer Emergency Response Team (CERT-In), and other specialized national cybersecurity agencies.
During the proceedings, Justice Joymalya Bagchi noted that the Union's legal officers have separately been asked to examine the broader statutory framework under the Information Technology Act to address modern cyber vulnerabilities and institutional shortcomings in investigating high-tech crimes.
The Supreme Court has sought responses from the Central Government and relevant agencies regarding the transfer of the investigation and interim measures to secure electronic evidence. Further hearings in the matter are expected following the submission of responses from the respondents.
Discription: The Supreme Court of India has issued a notice to the Union Government regarding a petition seeking a Central Bureau of Investigation (CBI) probe into a major cyberattack. Health-tech firm Vitraya Technologies alleged that sensitive medical records of nearly 1.5 lakh citizens across six states were compromised and transferred to Singapore-based servers, violating national data privacy norms.
Appearing before a Bench led by Chief Justice Surya Kant, counsel highlighted that local cyber police delayed registering an FIR by six months and charged only basic, bailable offenses against unknown persons. Citing inadequate state-level investigation into multi-state cybercrime and corporate rivalry, the petition demands a transfer to the CBI or a specialized Special Investigation Team (SIT).