Bombay High Court grants interim relief to HDFC Life, issues John Doe order against data extortionist

The Bombay High Court on Friday granted ad-interim relief to HDFC Life Insurance Company Ltd., issuing a John Doe order against an unidentified individual who allegedly threatened to leak confidential customer data. .John Doe orders are blanket cease and desist injunctions that are issued against anonymous entities. They are usually passed in suits involving infringement of intellectual property rights since it is often practically impossible to track down every infringing party.Single-judge Justice RI Chagla passed the order after concluding that HDFC Life had made a strong prima facie case against the unidentified person."Having considered the facts and the IT Rules, I find that the Plaintiff has made a strong prima facie case for ad-interim relief," the order said. The Court also directed Meta Platforms, WhatsApp and Telegram to take immediate action to remove accounts, content and phone numbers associated with the threatening communications..It further emphasized that disclosing sensitive customer data could cause significant harm, leading to identity theft, financial fraud, privacy violations, and unauthorized transactions. "Disclosure of the sensitive and confidential customer data can be highly damaging to both the Plaintiff and its customers. The Plaintiff has pointed out that publication, sale, or misuse of the data can result in identity theft, financial fraud, privacy violations, and unauthorized transactions. The data can be misused for a variety of purposes, including impersonating the Plaintiff, which would also involve infringement of the Plaintiff’s registered trademark and passing off," the single-judge stated. Damage from the cannot be compensated in terms of money especially since the defendant is an unknown entity, the Court said..The case arose when HDFC Life, a leading insurance company with approximately 6.6 crore customers and ₹63,076 crore in premium collections for the financial year 2023-24, received threatening emails from an anonymous sender. The sender claimed to have acquired a large volume of HDFC Life’s customer data and demanded to negotiate, threatening to leak and sell the information. The emails included sensitive details such as policy numbers, names, addresses, mobile numbers and receipt numbers. HDFC Life suspected a ransomware attack designed to extort money. On November 20, the sender escalated the threats, demanding 1,800 Ethereum (equivalent to Rs. 54.50 crore) in cryptocurrency and instructed the company to contact them via Telegram and WhatsApp..HDFC Life’s legal counsel emphasized the potential risks posed by the data breach, noting that the anonymous sender had also communicated through WhatsApp and Telegram. The company argued that the breach was part of a growing trend of ransomware attacks targeting financial institutions, which necessitated swift action to prevent further harm. The Court was urged to act to protect both HDFC Life and its customers from identity theft, financial fraud and privacy violations, which could not be reversed or compensated by monetary means..In response, the Court directed Meta, WhatsApp and Telegram to remove any content or accounts linked to the threats and file compliance reports preferably within 24 hours. The Court also directed the Union of India and the Ministry of Electronics and Information Technology to ensure that internet service providers swiftly block related accounts and content. A temporary injunction was imposed against John Doe to prevent the disclosure or distribution of confidential customer data and the platforms were ordered to disclose any available information identifying the individual behind the threats The matter will ne heard next on December 17 for compliance and additional ad-interim relief..Senior Advocate Sharan Jagtiani along with advocates Hiren Kamod, Sameer Pandit, K Gandhi and Chandni Turakhiya instructed by Wadia Ghandy and Co appeared for HDFC Life Insurance.Senior Advocate Cyrus Ardeshir with advocates Ritvik Kulkarni and Surya Ravikumar instructed by Khaitan and Co appeared for Telegram.Advocates Ashish Mehta and Dipsikha Deka instructed by Shreyas Deshpande appeared for the MeitY and Union of India..[Read Order]