Crl.O.P.No.17227 of 2026 IN THE HIGH COURT OF JUDICATURE AT MADRAS DATED : 03.07.2026 CORAM : THE HON’BLE MR.JUSTICE D.BHARATHA CHAKRAVARTHY Crl.O.P.No.17227 of 2026 and Crl.M.P.Nos.11488 and 11489 of 2026 Himanshu Pathak .. Petitioner Versus 1. The State of Tamil Nadu, Represented by the Inspector of Police, Delta-3 / Team-C, Cyber Crime Police Station, Central Crime Branch, Vepery, Chennai – 600 007. 2. Star Health and Allied Insurance Company Limited, Rep. by its Authorised Signatory / Chief Information Security Officer, Amarjeet Khanuja .. Respondents Prayer : Criminal Original Petition filed under Section 528 of BNSS, 2023, to quash the Final Report/charge sheet filed by the 1st respondent in CCB Cyber Crime Police Station Cr.No.02/2023, purportedly under Sections 66 read with 43(b) of the Information Technology Act, 2000, as amended, together with the order taking cognisance thereon and all further proceedings in C.C.No.564 of 2026 arising therefrom, pending on the file of the learned XI Metropolitan Magistrate / XI Judicial Magistrate, 1/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 Saidapet, Chennai – 15. For Petitioner : Mr.N.R.Elango, Senior Counsel, for Mr.Vishal Sridhar For Respondents : Mr.M.Mohamed Riyaz, Government Advocate (Crl. Side), for R1 : Mr.Shivathanumohan, for R2 ORDER This Criminal Original Petition is filed to quash the Final Report filed in C.C.No.564 of 2026 and all the proceedings that are pending on the file of the learned XI Metropolitan Magistrate / XI Judicial Magistrate, Saidapet, Chennai. 2. Upon perusal of the Final Report, it is seen that the case has been taken on file for the offences under Section 66 r/w Section 43(b) of the Information Technology (Amendment) Act, 2008. 3. Mr.N.R.Elango, learned Senior Counsel for the petitioner would submit that the petitioner’s father was subscribing to the policies of the second respondent, Star Health and Allied Insurance Company 2/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 Limited. While so, when the petitioner went through the records, he found that the system of the second respondent was vulnerable and since the petitioner was professional in dealing cyber security, he ethically pointed out the vulnerability in the A.P.I of the records maintained by the second respondent and has also duly and faithfully communicated the incident to the CERT-In. The effort was initially appreciated by the second respondent and they called the petitioner for several zoom meetings. When the petitioner effectively demonstrated before them and upon finding the petitioner very good in cyber security, they further negotiated how the things can be set right. The petitioner submitted that he himself is a professional in the field and can set right things for them. Merely because they could not agree on the costs, the second respondent went ahead and had given the complaint. 4. The respondent Police, firstly, had filed the charge sheet beyond the limitation period. Secondly, they did not even choose to examine the relevant witnesses namely, the persons who prepared the deloitte report in the appropriate regulatory agency and no relevant witnesses are even cited in the Final Report. When Section 66 of the Information Technology (Amendment) Act, 2008 clearly presupposes the 3/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 unauthorised extracting of data with a dishonest or fraudulent intention, in this case, no dishonest or fraudulent intention can even be spoken by the second respondent, especially, in the light of various correspondences that happened between the parties. The learned Senior Counsel would rely upon certain messages, e-mails and also transcripts of the zoom meetings made in that regard. All the time, the second respondent Company was describing the petitioner as a good samaritan and suddenly, they cannot turn around and allege dishonest and fraudulent intention on the part of the petitioner. In the absence of any material for dishonesty or fraud, there is no ground to proceed further with the trial and this Court should interfere and quash the Final Report. 5. Per contra, the learned Government Advocate (Criminal Side) for the first respondent would submit that when the complaint was given, after due investigation, the Final Report was filed. There is enough material to proceed further against the petitioner. The further allegation in the Final Report is that the petitioner did not stop with the ethical hacking, but, he bargained with the complainant not to leak the data if only they engaged him as a cyber security expert and threatened to leak the data. Therefore, that reveals the dishonest intention of the petitioner. 4/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 6. The learned Counsel for the second respondent would submit that there are several connected and other proceedings around the issue. Already, the second respondent had filed a Civil Suit for an injunction order restraining the petitioner from leaking the data and an injunction order has also been granted. In the said proceedings, the entire compact disc, containing the entire data which is unethically and unauthorisedly lifted from the second respondent’s systems, has been produced by the petitioner himself. Further, in the connected Writ Appeal in W.A.No.640 of 2026 etc., (batch cases), the Division Bench has found that the entire act done by the petitioner as unethical. 7. I have considered the rival submissions made on either side and perused the material records of the case. 8. Prima facie, as far as the contention of the learned Senior Counsel for the petitioner relating to limitation is concerned, it is said that the petitioner had earlier filed Crl.O.P.No.10781 of 2023 and there was also an interim order of stay and it was vacated and the petition was dismissed only on 30.03.2026. In view thereof, whether the Final Report 5/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 is within the period of limitation and how long the period of stay was there, all are questions to be determined during the course of trial. Therefore, I am not in a position to accept the contention of the learned Senior Counsel for the petitioner. 9. The second contention is that the petitioner has accessed the data with a good intention. In this regard, the first e-mail, that is said to have been written by the second respondent, dated 19.12.2022, has to be read as a whole. At one place, it says that the second respondent’s research team has spent amount of the efforts and time on researching these issues and writing a good report for the Star Health’s technical and executive team. It further goes on to state that they are hoping for a swift fix of the issues considering their criticality and they planned to publish about the issues through their own article through multiple reputed news publications nationwide and internationally, raising awareness about the importance of the data security and to lead the customers become aware about the horrible data security practices of the companies. 10. Further averments are also made that they should give a timeline and the second respondent would also be happy to help the 6/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 petitioner to fix the security issues. The relevant paragraph in the e-mail is extracted hereunder for ready reference:- “We would be hoping for a swift fix of the issues considering their criticality and also since we plan to publish about the issues through our own article and through multiple reputed news publications nationwide and internationally to raise awareness about the importance of data security and to let customers become aware about horrible data security practices of companies. Since we’re in talks with some reputed journalists (we’ve not shared the company’s name or vulnerability details till now with them, rather just a brief) about publishing about these issues, I’d request you and the team to give us a timeline about till when the issues will be fixed. That’ll be helpful. Just to be clear, we won’t publish or share our report with anyone until the issues are fixed to protect the people. We are open to discussing the details if you want. We are happy to help you fix your security posture and secure the customers data, in order to avoid such vulnerabilities and data exposes in future. Feel free to let us know!” 11. When there is a mix of the business interests of the petitioner with that of the ethical hacking, especially, when the petitioner has not gone ahead and publish these articles internationally, but, is only giving time to the Company and also had simultaneously making a plea to engage him for checking out the security issue, I am not able to accept the contention of the learned Senior Counsel that merely on the ground of reporting the incident to CERT-In, the petitioner’s good intentions stand vindicated. The question whether the petitioner had dishonest intention or 7/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 not, has to be gone into by appreciating the entire gamut of evidence including the transcripts of the zoom calls, the communication etc. Only after the petitioner cross-examines the prosecution witnesses and only on the appraisal of the evidence as a whole, the issue can be decided. At the outset, there is a prima facie material, by which, it is possible for the second respondent to contend that there is a dishonest intention. In view of the same, I am unable to agree with the learned Senior Counsel for the petitioner to quash the Final Report. The other contention relating to non- examination of the experts of ‘delloite’ report also revolves around adequacy of the evidence which cannot be a factor to be considered while considering the quash application of the Final Report. 12. Leaving open all the questions to be raised and contested during the trial, this Criminal Original Petition is disposed of. At this juncture, a prayer is made by the learned Senior Counsel for the petitioner citing the hardship of the petitioner to travel from Punjab to the Trial Court for all the hearings. Considering the hardship pleaded, the personal appearance of the petitioner is dispensed with before the Trial Court, except for the hearings that may be insisted upon by the Trial Court. Consequently, Crl.M.P.No.11488 of 2026, filed for an order of interim 8/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 stay, is closed. 03.07.2026 Neutral Citation : no grs To 1. The XI Metropolitan Magistrate / XI Judicial Magistrate, Saidapet, Chennai – 15 2. The Inspector of Police, Delta-3 / Team-C, Cyber Crime Police Station, Central Crime Branch, Vepery, Chennai – 600 007. 3. The Public Prosecutor, High Court of Madras. 9/10 https://www.mhc.tn.gov.in/judis Crl.O.P.No.17227 of 2026 D.BHARATHA CHAKRAVARTHY, J. grs Crl.O.P.No.17227 of 2026 and Crl.M.P.Nos.11488 and 11489 of 2026 03.07.2026 10/10 https://www.mhc.tn.gov.in/judis