Bombay High Court: A Single Judge Bench of R.I. Chagla, J., granted temporary injunction in favour of applicant-HDFC Life Insurance Co. Ltd. against Defendant 6-an unknown person, who wanted to extort money from applicant by threatening to leak confidential customer data. The Court, thus, restrained Defendant 6 from using, copying, publishing, distributing, transmitting, communicating, or disclosing to any person, confidential information and any other information relating to applicant that was not available in the public domain.
Background
Applicant was an insurance company registered with the Insurance Regulatory and Development Authority of India and had about 6.6 crore customers and premium collections of about Rs 63,076 crore for FY 2023-2024. Applicant operated under the brand “HDFC Life” which was also a registered trade mark of applicant and enjoyed a good reputation in the market. Applicant, as part of its business processes and statutory and regulatory requirements, including Know Your Customer (‘KYC’) Obligations, collected, and stored personal data relating to its customers. The data collected was to be used solely for meeting regulatory obligations and for providing services that the customer had availed of from applicant and all this information was provided by the customers to applicant on a highly confidential basis and was to be used only by applicant and regulators in accordance with law.
On 19-11-2024, applicant received emails from an anonymous and unnamed person-Defendant 6/John Doe, using an email address ‘bsdqwasdg@gmail.com’ and these emails alleged that Defendant 6 had acquired a large amount of applicant’s customer data. Applicant stated that Defendant 6 threatened to leak and sell the data if applicant did not negotiate with Defendant 6 and these emails contained samples of data that appeared to have been unlawfully acquired by Defendant 6. On 20-11-2024, Defendant 6 sent further emails asking applicant to contact them via Defendant 3-Telegram and also sent messages on Defendant 2-WhatsApp making similar threats. Defendant 6 also sought payment in 1800 Ethereum virtual coins which was a form of cryptocurrency and was equivalent to Rs 54.50 crore.
Applicant submitted that Defendant 6 breached the elaborate security measures put in place by applicant to protect customer data and confidential information and this was an orchestrated ransomware attack by Defendant 6 whose sole intention was to extort money from applicant by threatening to publish or sell confidential customer data. Applicant apprehended that Defendant 6 was likely to use the data to impersonate applicant by infringing applicant’s registered trademarks and/or by passing off. Applicant also submitted that such ransomware attacks had also been noticed by Defendant 5 who had published a paper on this issue titled “Ransomware Attack: An Evolving Targeted Threat” on its website.
Analysis, Law, and Decision
The Court opined that applicant made out a prima facie case for grant of ad-interim relief as disclosure of the sensitive and confidential customer data could be highly damaging to both applicant and its customers.
The Court noted that applicant had pointed out that publication, sale, or misuse of the data could result in identity theft, financial fraud, privacy violations, and unauthorized transactions. The Court opined that the data could be misused for a variety of purposes including for the purpose of impersonating applicant, which would also involve infringement of applicant’s registered trade mark and passing off and such damage could not be compensated in terms of money especially since Defendant 6 was an unknown entity.
Thus, the Court till the final disposal of the present suit, granted temporary injunction restraining Defendant 6 and their directors, proprietors, operators, partners, employees, agents, servants, and affiliates and any persons claiming through them from using, copying, publishing, distributing, transmitting, communicating, or disclosing to any person the confidential information and any other information relating to applicant that was not available in the public domain by any medium whatsoever or on any platform whatsoever.
The Court directed Defendants 1 to 5 to take steps necessary to: (a) forthwith remove, delete, block, and disable accounts, content, domain names, and phone numbers and email addresses associated with such accounts and (2) upon intimation by applicant, remove, delete, block, and disable accounts, content, domain names, and phone numbers and email addresses associated with such accounts that might use, copy, publish, distribute, transmit, communicate, or otherwise disclose any confidential information relating to applicant, and file an affidavit of compliance in that regard before this Court.
The Court also directed Defendants 4 and 5 to issue necessary instructions to internet service providers, Intermediaries, and other relevant authorities to remove, delete, block, and disable accounts, content, domain names, and phone numbers and email addresses associated with such accounts. Further, the Court directed Defendants 1 to 3, to disclose on affidavit before this Court, all available details of Defendant 6, including their names, associated addresses, email addresses, contact details including phone numbers, organization and associations, URL(s), and IP addresses based on the account details and based on such other accounts details that applicant might subsequently discover.
The matter would next be listed on 17-12-2024 for compliance and further ad-interim relief.
[HDFC Life Insurance Co. Ltd. v. Meta Platforms Inc., Interim Application (L) No. 35886 of 2024, decided on 29-11-2024]
Advocates who appeared in this case :
For the Applicant: Sharan Jagtiani, Senior Advocate, Hiren Kamod, Sameer Pandit, K. Gandhi and Chandni Turakhiya i/b. Wadia Ghandy and Co. for the Applicant/Plaintiff.
For the Defendants: Cyrus Ardeshir, Senior Advocate, Ritvik Kulkarni and Surya Ravikumar i/b. Khaitan and Co. for Defendant 3; Ashish Mehta, Dipsikha Deka i/b. Shreyas Deshpande for the Defendants 4 and 5.
The post appeared first on .