India's Supreme Court orders CBI investigation of Vitraya health‑tech data breach

The Supreme Court of India issued notice on a petition filed by Vitraya Technologies Private Limited, a health‑tech firm that operates a blockchain‑based platform for real‑time health‑insurance claim settlement. The petition seeks a CBI‑led or court‑monitored SIT probe after a cyber‑attack that allegedly exposed personal and medical data of about 150,000 Indian citizens across six states.

Vitraya says the breach involved more than 42,000 unauthorized login attempts in February 2025, with data later routed to a server in Singapore, allegedly violating IRDAI rules that require Indian insurance data to remain on Indian servers. The company alleges competitors – Remedinet Technologies, IHX Private Ltd and Medi Assist – and their common investor Bessemer Venture Partners coordinated the attack. An FIR filed in August 2025 cited only Section 66 of the IT Act, prompting the request for a stronger investigation. The bench, comprising Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V Mohan, also asked the Solicitor General to review possible amendments to the IT Act.