Star Health Data Breach Case: Supreme Court Lets Prosecution Proceed
Star Health data breach case remains active as the Supreme Court clears the way for prosecution to proceed, keeping the insurer under legal scrutiny.
Star Health faces continued prosecution in the data breach case after the Supreme Court allowed the proceedings to move ahead.
NEW DELHI, Star Health: The Supreme Court has declined to step into the criminal case against cybersecurity researcher Himanshu Pathak, who stands accused by Star Health and Allied Insurance Company of improperly accessing and taking sensitive customer records from the insurer’s systems. The ruling means the prosecution will go on, and the larger question of whether Pathak was a good-faith researcher or something else will be decided by a trial court.
The court refused to entertain his petitions but kept open his right to put forward his defence before the trial court. It had earlier directed him to appear before the XI Metropolitan Magistrate in Chennai and furnish bail bonds.
Star Health: What Star Health alleges
Star Health says Pathak accessed and downloaded roughly 8,000 files holding customers’ personal, health and financial details. The insurer further claims he later tried to put pressure on the company by alluding to the possible publication of information while pitching his cybersecurity services.
Pathak rejects this account. He says he found serious weaknesses in Star Health’s systems, reported them to the insurer and to a cybersecurity platform, and pressed for fixes. He denies any intention of misusing customer information.
Star Health: Arguments before the bench
Advocate Prashant Bhushan, appearing for Pathak, disputed Star Health’s description of his client as a habitual offender. The insurer had cited a separate FIR against Pathak, filed after a complaint by Policybazaar.com that involved similar allegations. Bhushan argued that the investigation in that matter supported Pathak’s claim to be a security researcher, and that the matter had been closed.
He also said Pathak had reported vulnerabilities to other organisations, including Punjab National Bank, Vodafone and CDSL, which acknowledged the reports and took corrective steps. According to the defence, Pathak never published customer data or passed it to unauthorised people. It argued that the files were downloaded only to show Star Health how far the flaw extended.
The bench concentrated on the downloading itself. It asked whether pulling such a large volume of records was needed to demonstrate a security gap, and observed that once personal data is downloaded, the privacy interests of the people whose records are involved enter the picture.
Bhushan replied that showing mere access would not convey the scale of the weakness, and that the material was used only to show Star Health the extent of the problem and was never made public.
The bench indicated that the competing versions would need evidence to resolve. It questioned whether a dispute over Pathak’s intent and conduct could be settled while considering a plea to quash the case.
Star Health: Emails and the question of fees
Senior Advocate S. Muralidhar, appearing for Star Health, relied on exchanges between Pathak and the insurer. He argued that the emails went beyond an ordinary vulnerability disclosure and should be read alongside the alleged downloading of customer data.
Muralidhar also pointed to communications in which Pathak allegedly proposed charging $65,000 for an attack-surface analysis and $3,000 a month for maintenance. In his submission, the payment discussions, the alleged possession of thousands of customer files and the references to publication together supported the prosecution’s case.
The defence rejected the extortion allegation. Bhushan said the sequence of events showed that Pathak first found the vulnerability, told Star Health and sought remediation, and that talk of paid cybersecurity work came afterwards.
Star Health: What happens next
The Supreme Court did not rule on whether Pathak’s actions amounted to legitimate security research or a crime. It left those questions to the trial court and allowed the prosecution arising from Star Health’s complaint to proceed.
