The Bombay High Court has granted an urgent ad-interim injunction against an unidentified ransomware group threatening to leak 1TB of confidential corporate data, affirming that courts can intervene preemptively to prevent irreparable harm to proprietary information and client privacy. This order sets a significant precedent for corporate entities facing cyber extortion in India.
Background & Facts
The Dispute
Adfactors PR Private Ltd, a private limited company providing integrated public relations and capital markets communications services, filed a suit seeking permanent injunctive relief against Defendant No. 1 (Ashok Kumar or John Doe) and Defendant No. 2 (BlackShrantac ransomware group). The plaintiff alleges that Defendant No. 2, operating through anonymized channels and the dark web, exfiltrated approximately 1 terabyte of internal data, including client communications, campaign strategies, and proprietary workflows, and threatened to publish it unless demands were met.
Key Facts
- Plaintiff operates across 40 Indian cities and maintains offices in India, Sri Lanka, and Singapore
- Plaintiff serves clients in approximately 25 industry sectors
- Plaintiff holds ISO 27001:2022 certification and employs enterprise-grade security protocols
- On 29.03.2026 at 7:20:32 a.m., Plaintiff received an email from [email protected] with subject: "BlackShrantac's Note : Your name will be disclosure within 24 hours on our Darkweb"
- The email explicitly admitted to unauthorized exfiltration of 1TB of internal data and threatened public disclosure within 24 hours
- On 30.03.2026, a post appeared on social media platform "X" (formerly Twitter) by the threat reporting account "Ransomware Alert", confirming the breach and stating the data would be published within 1-2 days
- Plaintiff filed a private complaint with N.M. Joshi Marg Police Station on 25.03.2026
- Plaintiff reported the incident to Indian Computer Emergency Response Team (CERT-In) on 25.03.2026 (Exh. "J")
- Defendant No. 2’s identity, location, and physical address remain unknown; only the email ID [email protected] is available
- Plaintiff’s revenue for FY 2024-25 was Rs. 567 crore
- Defendant No. 2 was first identified in September 2025 and has targeted multiple organizations across critical sectors
Procedural History
- 25.03.2026: Private complaint filed with N.M. Joshi Marg Police Station
- 25.03.2026: Cyber incident reported to CERT-In
- 29.03.2026: Ransomware threat email received
- 30.03.2026: Threat posted on platform "X"
- 31.03.2026: Suit (L) No. 11528 of 2026 filed before Bombay High Court
- 31.03.2026: Interim Application (L) No. 11529 of 2026 filed seeking urgent ad-interim relief
- 31.03.2026: Court heard application on holiday due to exigency
- 31.03.2026: Court granted leave to amend prayer clause (d) to insert the word "not" for clarity
- 31.03.2026: Court granted leave to implead platform "X" as Defendant No. 4
The Parties' Positions
For the Plaintiff
- Argued that unauthorized access, exfiltration, and threat of disclosure constitute a data crime under the Information Technology Act, 2000 and Indian Penal Code
- Emphasized fiduciary duty to protect client data and potential violation of Article 21 right to privacy
- Cited the IT Rules, 2011 on reasonable security practices and sensitive personal data
- Highlighted imminent risk of catastrophic reputational, financial, and legal harm
- Stated that Defendant No. 2 operates anonymously from foreign jurisdictions
- Requested John Doe injunction to restrain unknown parties
For the Defendants
- No appearance or submissions made
Relief Sought
- Temporary injunction restraining use, copying, publishing, distributing, transmitting, disclosing, selling, or leaking the stolen data
- Direction to delete all stolen data from Defendant’s systems
- Direction not to disclose or publicize the suit filed before the Court
- Leave to implead platform "X" as Defendant No. 4
The Legal Issue
Can a court grant an ad-interim John Doe injunction against an unidentified ransomware group threatening to disclose confidential corporate data, where the threat is imminent, the harm irreparable, and the identity of the perpetrator unknown?
Arguments Presented
For the Appellant/Petitioner
The plaintiff relied on the Information Technology Act, 2000, particularly Section 75, which extends the Act’s jurisdiction to offences committed outside India if the computer system involved is located in India. It also invoked Sections 3 and 4 of the Indian Penal Code, 1860, establishing extraterritorial application of criminal law. The plaintiff argued that the threat of disclosure constitutes a data crime, not mere "theft," and falls under Section 66 of the IT Act (computer-related offences) and Section 420 IPC (cheating). It further cited the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which impose obligations on data custodians and recognize the privacy rights of individuals. The plaintiff emphasized that failure to grant relief would result in irreversible reputational damage, loss of client trust, and cascading litigation.
For the Respondent/State
No submissions were made by the respondents, as they remained unidentified and unrepresented.
The Court's Analysis
The Court found that the plaintiff had established a prima facie case with a clear threat of imminent harm. The email dated 29.03.2026 and the subsequent post on platform "X" constituted credible, time-sensitive threats. The Court noted that the term "data theft" is legally inaccurate; the correct characterization is data crime, governed by the IT Act and IPC. The Court emphasized that Section 75 of the IT Act enables Indian courts to act against offenders operating from abroad if the target system is in India, which was clearly the case here.
"The threat perception from Defendant No. 2 is prima facie evident as it states that the data will be disclosed and Plaintiff would be aware about the consequences."
The Court held that the balance of convenience overwhelmingly favored the plaintiff. If the data were disclosed, the harm would be irreversible: clients would suffer reputational damage, litigation would multiply, and the plaintiff’s business credibility would be severely compromised. The Court also recognized that the plaintiff, as a fiduciary custodian of client data, had a duty to prevent unauthorized dissemination, and failure to act would violate the expanded right to privacy under Article 21.
The Court further acknowledged the practical impossibility of identifying Defendant No. 2 at this stage and accepted the use of a John Doe injunction as a necessary procedural tool to preserve rights against unknown parties. The Court also permitted the impleadment of platform "X" as Defendant No. 4, recognizing its role as a conduit for the threat, and granted the plaintiff one week to amend pleadings.
The Verdict
The plaintiff succeeded. The Court granted ad-interim relief as prayed in clauses (a), (c), and (d) of the Interim Application. The defendants, including John Doe and BlackShrantac, are restrained from using, copying, publishing, distributing, transmitting, disclosing, selling, or leaking the stolen 1TB of internal data by any medium or platform. They are directed to delete all such data from their systems. They are also restrained from disclosing or publicizing the suit filed before the Court. Notice to the defendants is issued returnable on 22.04.2026. The plaintiff must serve a copy of the suit, interim application, and this order on the defendants by any permissible mode and file proof of service by 22.04.2026. The plaintiff is granted one week to implead platform "X" as Defendant No. 4.
What This Means For Similar Cases
John Doe Injunctions Are Viable Against Anonymous Cyber Threats
- Practitioners may now confidently seek John Doe injunctions against ransomware groups or hackers whose identities are unknown but whose threat is credible and imminent
- Courts will prioritize prevention over waiting for actual harm when data exposure is likely and irreversible
- Evidence of threat (email, social media post, CERT-In report) is sufficient to establish prima facie case
Data Crimes Trigger Extraterritorial Jurisdiction Under IT Act
- Section 75 of the IT Act, 2000 applies even if the attacker is located abroad, provided the compromised system is in India
- This empowers Indian entities to seek remedies against foreign-based cybercriminals without requiring international cooperation at the interim stage
- Courts may now treat cyber extortion as a civil wrong actionable under injunction law, independent of criminal proceedings
Fiduciary Duty to Protect Client Data Is Legally Enforceable
-
Companies handling sensitive client information must implement robust security measures to avoid liability
-
Failure to act against a known threat may expose firms to claims of negligence or breach of fiduciary duty
-
The IT Rules, 2011, while not creating private rights of action, provide a benchmark for reasonable care in data handling
-
Always document cyber incidents with timestamps, screenshots, and CERT-In reports
-
File suits immediately upon threat detection to establish urgency
-
Consider impleading platforms hosting threats as defendants to facilitate takedown
