Back
2026 Supreme(Mad) 1409
IN THE HIGH COURT OF JUDICATURE AT MADRAS
Sushrut Arvind Dharmadhikari, C.J., G.Arul Murugan, J.
Himanshu Pathak - Appellant
Versus
Ministry of Electronics and Information Technology, Electronics Niketan, 6, CGO Complex, Lodhi Road, New Delhi – Respondent
W.A.Nos.640, 641, 645, 827, 828 and 829 of 2026
Decided On : 08-04-2026
For the Appellant : Mr.Nithyaesh Nataraj for Mr.Vaibhav Rangarajan Venkatesh
For the Respondent: Mr.Krishna Srinivasan Senior Counsel for M/s.S.Ramasubramaniam and Associates
The court ruled that ongoing civil and criminal proceedings regarding unauthorized data access preclude further regulatory action on complaints related to cybersecurity vulnerabilities.
Headnote:(A) Information Technology Act, 2000 - Sections 43 and 66 - Writ appeals against rejection of complaints regarding cyber vulnerabilities of an insurance company - Appellant identifiedwebsite vulnerabilities but unauthorizedly accessed data and received interim injunction prohibiting further actions - Writ court held issues sub judice in ongoing civil/criminal cases and declined to further entertain complaints. (Paras 1, 3, 7, 40)
(B) Cybersecurity and Legal Responsibility - Insurance companies are obligated to protect customer data; unauthorized access by cybersecurity expert poses legal questions; proper regulatory measures must be enforced to prevent vulnerabilities, as noted by various authorities. (Paras 11, 12, 29, 35)
Facts of the case:
The appellant, a cybersecurity expert and policyholder of the respondent insurance company, identified vulnerabilities in their website. Despite noting the issues, he accessed data without authorization, leading to legal actions from the insurance company against him. These actions included a civil suit and a criminal filing for data breaches under the Information Technology Act.
Findings of Court:
The court upheld the writ court's decision that further action could not be taken by regulatory authorities while civil and criminal proceedings are pending, reinforcing that any claims regarding the insurance company's responsibilities must wait until the civil litigation is resolved.
Issues: The main issue concerned whether the appellant's complaints regarding data vulnerabilities could be addressed while legal proceedings concerning unauthorized access were ongoing.
Ratio Decidendi: The court reasoned that as the issues were already legally contentious, the appellant must await resolutions in existing suits before pursuing claims regarding perceived negligence by the insurance company.
Result: Writ appeals dismissed.
JUDGMENT :
G.ARUL MURUGAN, J.
All these set of intra-court appeals are directed against the common order of the writ court dated 23.10.2024, whereby directions sought against each of the respondents to take action against the 7th respondent/Insurance Company based on the petitioner’s complaint, came to be rejected.
2. Since these writ appeals arise out of the common order passed in the writ petitions, all these writ appeals are heard together and disposed of by this common order.
3. The short facts to be noted in these writ appeals are that the 7th respondent is a private Insurance Company providing insurance policies to various customers in accordance to their needs. The 7th respondent is also one of the leading and largest company in insurance sector. The appellant is a policy holder/customer of the 7th respondent and is holding a valid insurance policy.
4. As a customer, the appellant is provided with access to the web applications of the 7th respondent to view his policy details through a login ID and password. According to the appellant, when he viewed the details of his policy from the 7th respondent’s website and since he is also indulged in providing cyber security services, he happened to note that there are certain vulnerabilities in the website of the 7th respondent whereby a third party could have access to view the profile of the other policy holders and thereby, there is every opportunity for the data to get stolen. In such event, the personal details of the policy holders of the 7th respondent may be stolen by hackers and therefore, he had intimated about the vulnerabilities to the 7th respondent through e-mail dated 19.12.2022. Further, according to the appellant, the 7th respondent had in fact thanked him for bringing to their notice about the vulnerabilities.
5. However, the 7th respondent filed a suit before this Court in C.S.No.1 of 2023 against the appellant and obtained an order of ad-interim injunction on 03.01.2023 as if the appellant had unauthorisedly accessed and collected data of the 7th respondent and stolen the same. The interim injunction was made absolute and the application was allowed on 07.06.2023. The interim injunction granted was also confirmed by the Division Bench of this Court on 12.06.2024 in the appeal preferred by the appellant in O.S.A.(CAD)Nos.109 and 110 of 2023. Further, based on the complaint of the 7th respondent, FIR also came to be registered against the appellant in Crime No.2 of 2023 by CCD-I, Chennai City, for offences under Sections 66 and 43(b) of the Information Technology Act, 2000 (hereinafter referred to as “the Act”).
6. While so, alleging that in view of the lapses on the part of the 7th respondent, which led to the vulnerabilities by putting the personal details of various customers at risk of being stolen by the hackers, the appellant had preferred a complaint on 13.01.2023 to the 5th respondent/IRDAI and on 07.03.2023 to each of the other respondents 1 to 4 and 6. Since, according to the appellant, no action was taken, he had preferred the batch of writ petitions against the respondents.
7. The writ court, on considering the issue, came to the conclusion that since the issue of vulnerabilities and data breach raised by the appellant in respect of the 7th respondent/Insurance Company is already sub judice before the Court in C.S.No.1 of 2023 and also the interim injunction was granted in the suit and confirmed by the appellate court which is still operating, no further proceedings can be taken by any of the authorities till the issue is decided in the suit. The writ court had also granted liberty to the appellant to work out his remedy in accordance with law after disposal of the suit.
8. Aggrieved, the appellant assailing the common order has preferred separate writ appeals.
9. Mr.Nithyaesh Nataraj, learned counsel appearing for the appellant argued that in view of the vulnerability in the website of the 7th respondent, apart from the personal details of the appellant, th
