Delhi High Court issues injunction after Niva Bupa receives another data leak threat

The Delhi High Court recently granted interim relief to Niva Bupa Health Insurance Company Limited in a case involving a data breach and extortion attempt by an anonymous hacker. .Justice Mini Pushkarna issued a series of directives to prevent the dissemination of sensitive customer data and to identify the perpetrators behind the cyberattack. "The plaintiff has demonstrated a prima facie case for grant of injunction and in case no ex-parte ad-interim injunction is granted, the plaintiff will suffer an irreparable loss. Further, the balance of convenience also lies in favour of the plaintiff and against the defendants," the Court said..Niva Bupa, a leading health insurance company in India, filed a suit seeking permanent injunction and damages against an anonymous defendant, referred to as "John Doe" (Defendant No. 15) for unlawfully accessing and threatening to leak confidential customer data. The breach came to light on February 20, when Niva Bupa’s top executives received an email from an anonymous sender claiming to have accessed sensitive customer and insurance claims data. The hacker demanded a ransom and threatened to publish the data on a website, NivaBupaLeaks.com, if their demands were not met.The hacker, identifying themselves as "xenZen," claimed to have successfully executed similar attacks on other insurance companies, including Star Health, and warned Niva Bupa of severe consequences if they failed to comply. Over the next few days, the hacker sent multiple emails containing samples of the stolen data, including policy details, customer information and threats of further leaks..In a suit seeking directions to restrain disclosure of the information, the company highlighted the severe risks posed by the breach, including identity theft, financial fraud and reputational damage to both the company and its customers. Niva Bupa also highlighted the potential for competitors to misuse the stolen data, which could undermine its market position and customer trust.Finding a prima facie case made out for grant of injunction, the Court passed the following directions:.Take Down of Websites and Email IDs: The domain name registrar and the authorities were directed to remove, block, and disable the websites NivaBupaLeaks.com and https://nivabupaleaks.st/, as well as the email IDs used by the hacker, within 24 hours of being notified by Niva Bupa.Restriction on Data Dissemination: The John Doe defendant and associates were restrained from using, copying, publishing, or distributing Niva Bupa’s confidential information through any medium or platform.Trademark Protection: The Court also restrained the defendant from infringing Niva Bupa’s trademarks, including “Bupa” and “Niva Bupa,” and from creating any content that could mislead the public into believing an association with the company.Disclosure of Hacker’s Details: The authorities and the domain name host were directed to disclose all known details of the defendant including KYC information, contact details, and IP addresses associated with the rogue websites and email IDs.Preventive Measures: The Court also ordered domain name registrars and internet service providers to block any future attempts to register domains or websites using Niva Bupa’s trademarks..The Court in the order passed on February 28 issued notices to all defendants and directed them to file their replies within four weeks.The case will be heard next on August 28..This is second time in the recent months that the insurance company has suffered a data breach. In November 2024, the company had received an email from a hacker who claimed to have obtained access to a large part of its sensitive customer data.The company had approached the High Court then too and a similar order was passed directing various online platforms including Telegram to ensure blocking of accounts linked to the anonymous hacker..Niva Bupa was represented by Senior Advocate Pradeep K Bakshi and a team from White & Brief - Advocates & Solicitors led by partner Mohit Bakshi and also comprising associates Pururaj Agarwal and Akshit Narula..[Read Order]