SC issues notice on plea seeking CBI probe into alleged medical data breach affecting 2 lakh Indians

New Delhi: The Supreme Court of India has issued notice on a plea seeking a CBI probe into an alleged large-scale cyber attack and medical data breach affecting nearly two lakh Indian citizens.

According to a recent report by LawBeat, the data breach allegedly occurred by companies promoted by Bessemer Venture Partners, including Remedinet Technologies Pvt. Ltd., IHX Pvt. Ltd., Medi Assist and Perfios Software Solutions Pvt. Ltd.. It has been alleged that they purportedly compromised the sensitive personal and medical data of Indians across six States.

After hearing the matter, the Apex Court bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana permitted dasti service of notice upon the Union of India and the concerned States at the request of the petitioner, Law Beat has reported.

Details of petition:

The plea, filed by Vitraya Technologies Pvt. Ltd., alleged that companies promoted by Bessemer Venture Partners, including Remedinet Technologies Pvt. Ltd., IHX Pvt. Ltd., Medi Assist and Perfios Software Solutions Pvt. Ltd., were involved in a coordinated cyber intrusion targeting the digital infrastructure of the petitioner.

Filed through Advocate-on-Record (AoR) Abhinav Agarwal, the plea argued that the alleged cyber attack involved sophisticated hacking methods, including brute-force login attempts, mass downloading of confidential records and unauthorised access to the digital system of the petitioner (Vitraya Technologies).

Further, it alleged that the matter involved multi-jurisdictional cybercrime, cross-border transfer of data and nationwide implications for citizens' informational privacy.

The petitioner invoked the Apex Court's judgment in the case of Justice K.S. Puttaswamy (Retd.) v. Union of India, and argued that the breach strikes at the heart of the fundamental right to privacy under Article 21 of the Constitution.

Also Read: Health Ministry denies reports claiming CoWIN data breach, says will start probe

Relief Sought:

Filing the plea, the petitioner sought transfer of the investigation from the Punjab Police to the Central Bureau of Investigation (CBI) and alleged ineffectiveness of the local probe as the reason, along with the lacking in impartiality.

Apart from seeking transfer of the investigation to CBI, the petitioner also urged the Supreme Court to set up a court-monitored Special Investigation Team (SIT) comprising the CBI, CERT-In and other specialised cyber and national security agencies for conducting an independent, expert-driven and time-bound investigation into the alleged data breach.

Further, the petitioner has also sought directions to immediately preserve all electronic evidence including servers, IP logs, authentication records, cloud infrastructure, digital devices and other relevant data and conduct forensic examination of the same in relation to the alleged cyber attack. It was argued by the petitioner that such measures are essential to prevent the destruction, tampering or disappearance of crucial digital evidence.

Hearing before Apex Court:

As per the latest media report by Law Beat, the counsel for the petitioner, Senior Advocate K. Parameshwar, submitted before the top court bench that due to the breach, extremely sensitive personal information, including Aadhaar details, PAN cards, medical records, insurance claim information and other personally identifiable data of approximately two lakh Indian citizens were compromised. It was submitted by the counsel that the compromised data was allegedly transferred to a server located in Singapore.

"I filed my complaint in March 2025. It took authorities till August 2025 just to register an FIR. I even gave details of the Singapore server where the data had gone. Yet, the FIR is still against unknown persons. How do I trust this investigation? That is why I am before Your Lordships seeking a CBI inquiry," submitted the counsel.

He further submitted before the top court bench that only after repeated representations and continuous follow-ups, the Punjab State Cyber Crime Police Station registered an FIR in this connection on August 29, 2025. He also argued that even though the FIR was lodged, it was done mechanically under only Sections 66 and 66B of the Information Technology Act against "unknown persons," although the investigating agency had been supplied with details of the alleged Singapore server and the entities allegedly responsible.

The plea alleged that the delay in registration of the FIR, coupled with the failure to conduct any meaningful forensic investigation or seize digital evidence, has raised serious doubts regarding the fairness and effectiveness of the investigation.

During the hearing of the case, the counsel further submitted, "This is a serious case. I have identified where the breaches originated, who is responsible, and where the data has gone."

Taking note of the submissions, the Apex Court bench issued notice in the matter. Justice Bagchi observed that the Court had already requested the Solicitor General to examine the need for amendments to the Information Technology Act.

"We have already asked the Solicitor General to relook at the Information Technology Act and consider amendments," he observed.

In response to this, the counsel for the petitioner submitted that the FIR in this case invoked only Section 66 of the Information Technology Act. "That is not effective at all," he argued.

Also Read: Massive data breach: ICMR data leak reveals information of 81.5 crore Indians on dark web