HDFC Asset Management Company vs Union Of India And Others

Shreeram V. Shirsat, J

Heard learned counsel Mr. Aviral Sahai for the Applicant /Plaintiff in Interim Application (L) No. 18004 of 2026.

The learned counsel for the Applicant has placed on record the affidavit of service contending that the Defendant Nos. 1 and 2 have been duly served through email on 22nd May 2026. The said affidavit is taken on record. However, despite service, Defendant Nos. 1 and 2 have chosen not to appear.

At the outset the learned counsel for the Applicant submitted that there is grave urgency in the matter and hence urged this Court to take up the Interim Application for seeking interim reliefs. The interim application is immediately taken up for hearing considering the urgency.

The learned counsel submitted that this is an application filed on behalf of the Applicant seeking temporary injunction against Defendant No. 3 from using, publishing, distributing transmitting, communicating or disclosing to any person the confidential data stolen by Defendant No. 3 from the Plaintiff and further seeking direction to Defendant Nos. 1 and 2 to take steps to remove, delete, block and disable accounts, content, domain names, phone numbers and email addresses in relation to confidential data stolen by Defendant No. 3 from the Plaintiff and such other prayers as mentioned in the application.

The learned counsel for the Applicant/Plaintiff submitted that the Applicant/Plaintiff is one of the India's leading asset management company providing investment management and investment advisory services, to the millions of unit holders of HDFC mutual fund and manages assets on behalf of millions of investors across India. The learned counsel further submits that the Applicant/Plaintiff is entrusted with the management of public investments and is custodian of the confidential data of millions of investors across India. The learned counsel further submitted that the said data inter alia includes names, addresses, identity documents, PAN details, bank account details, port-folio details, investment details, mobile numbers, email addresses, the distributor/advisor through whom investment is made, and other personal and financial information and all such data is provided by the Applicant's customers and investors on the highest confidential basis and the Applicant/Plaintiff is obligated, both contractually and statutorily to safeguard the same. The Ld. Counsel further submitted that Applicant/Plaintiff has developed proprietary analyses and investment ideologies in the interest of and for the benefit of its customers, which data is confidential and proprietary in nature. He further submitted that the Applicant's data also consists of private financial data of the Applicant and its subsidiary as well as personal data of its employees.

The learned counsel submitted that on 16th May, 2026 at about 8.30 am, the Plaintiff's IT Administrator reported inability to access the on-premises V Mware setup, thereby indicating that something was amiss with the Applicant's IT infrastructure and it affected several critical systems and servers, such as SFTP, DLP, VPN servers, old antivirus VDI management server etc. The learned counsel further submitted that the Applicant's IT infrastructure discovered an email dated 16th May, 2026 which was issued by an entity named "Morpheus" claiming exfiltration of over 680 GB of critical data from the Applicant's infrastructure. The email further stated that in order to prevent leakage of confidential data, the Applicant must contact Defendant No. 3 within 3 days. The learned counsel for the Applicant also invited the attention of this court to the contents of the email which is reproduced herein below:

"Exercise caution while opening attachments/ links. Hello, we are writing to inform you that you company has been compromised. Over 680 GB of critical data has been exfiltrated. To prevent this information from being leaked online, you must contact us within 3 days. You already have your own credentials. Onion URL: izspipui4ct gxfugbgtu65kzefructyfpbxplmfybl5swiadplimyd. Onion Login : hdfcfund Password: if7@#@BJAQ*@D, Mail: morpheus. support@onionmailorg. Official Tor website: https:// www. Torproject.org/download."

Mr. Sahai, the learned counsel for the Applicant/Plaintiff submitted that upon discovery of such an email, the Applicant's have immediately taken steps at their end and activated necessary protocols for containment of the damage caused by such incident and even conducted a business impact analysis. Further the Applicant has also shut down affected servers and also deactivated the credentials of privileged users who had access to the impacted environment. The learned counsel further submitted that the Applicant has further issued an email dated 16th May, 2026 to SEBI thereby reporting the cyber security incident and also reported the incident report on CERT In portal on the same day. Further a disclosure notice was also issued on 18th May, 2026 in terms of regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 to the NSE and BSE and a detailed cyber incident interim report was submitted on 18th May, 2026 with SEBI, in terms of cyber security and cyber resilience frame work for SEBI regulated entities and also with Reserve Bank of India and CERT in portal.

The learned counsel further submitted that Applicant's server and network related data had been breached by Defendant No. 3 pursuant to which the Applicant's network was attacked. The Ld. Counsel expressed his apprehension that ransomware attack carried out by Defendant No. 3 in the name of "Morpheus" appears to be a ransomware group which has been targeting numerous victims, and leaking stolen data on the dark web.

The learned counsel further submitted that there is persistent threat that the confidential data may be leaked without any further notice. The learned counsel further submitted that the dissemination of confidential data would not only expose millions of individual investors to immediate risks of identity theft, financial fraud, phishing attacks, SIM swapping schemes, and unauthorized financial transactions, it will also adversely affect the Plaintiff's investors, employees, distribution partners, directors, shareholders and stakeholders.

After hearing for the submissions by the learned counsel for the Applicant and upon perusal of the records of the case and the document annexed thereto, prima facie arguable case is made out for the grant of ad-interim relief. The primary reason which impels me to pass the order is in view of the fact that Defendant No. 3 is a ransomware group which has threatened vide email dated 16th May 2026, that the company has been compromised and over 680 GB of critical data has been exfiltrated. Therefore at this stage, balance of convenience lies in the favour of the Applicant as, if the confidential data is misused or leaked or traded or compromised, it will lead to dreadful consequences and it can also cause irreparable and irreversible damage to the Applicant/Plaintiff company and all other associated with the said company.

In view of the above, ad interim relief is granted in terms of prayer clauses (a) (b) (c) (d) which read as under:

a) Pending the hearing and final disposal of the present Suit, pass an order of temporary injunction against Defendant No. 3, its directors, proprietors, operators, partners, employees, agents, servants and affiliates and any persons claiming through them from using, copying, publishing, distributing, transmitting, communicating or disclosing to any person the Confidential Data stolen by Defendant No. 3 from the Plaintiff and any other information relating to the Plaintiff that is not available in the public domain by any medium whatsoever or on any platform whatsoever;

b) Pending the hearing and final disposal of the present Suit, direct Defendant Nos. 1 and 2 to take all steps necessary to forthwith remove, delete, block and disable accounts, content, domain names and phone numbers and email addresses in relation to the Confidential Data stolen by Defendant No. 3 from the Plaintiff, within 24 hours of intimation by the Plaintiff and file an affidavit of compliance in that regard before this Hon'ble Court;

c) Pending the hearing and final disposal of the present Suit, direct Defendant Nos. 1 and 2 to take all necessary steps to remove, delete, block and disable accounts, content, domain names and phone numbers and email addresses associated with such accounts, that use the Plaintiff's name, likeness or marks, within 24 hours of intimation by the Plaintiff and file an affidavit of compliance in that regard before this Hon'ble Court; and

d) Pending the hearing and final disposal of the present Suit, direct Defendant Nos. 1 and 2 to issue necessary instructions to internet service providers, intermediaries and other relevant authorities to remove, delete, block and disable accounts, content, domain names and phone numbers and email address associated with such accounts.

In view of the above, issue notice to the Respondents/Defendants returnable on 16th June 2026.

Humdast permitted.

In addition to the Court's notice, the Applicant/Plaintiff is directed to serve the copy of Interim Application along with the copy of this order on the Respondents/Defendants and inform them about the next day of hearing, by any permissible mode of service, and file appropriate affidavit of service on or before the next date.

Reply shall be filed by the Respondents before the next date.

Stand over to 16th June, 2026 for hearing the Interim Application.

Interim order to continue till the next date.