ANNEXURE P/1

HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ

FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

1. District ǔ«›ȡ GURUGRAM P.S. ȡ“ȡ Cyber Crime Year Ÿ[ 
Police Station, Gurugram
FIR No. Ĥ Ǘǐš Ȳ  Date Ǒ‘“ȡȲ€ 


2. S.No. Acts \ͬ’Ǔ“™˜ Sections ’ȡšȡ fȱ

Đ Ȳ
1 INFORMATION 43
TECHNOLOGY
(AMENDMENT) ACT 2008
2 INFORMATION 66
TECHNOLOGY
(AMENDMENT) ACT 2008

3. (a) Occurrence of offence \”šȡ’€ȧƒŠ“ȡ 

1 Day Ǒ‘“ Intervening Days Date from Ǒ‘“ȡȲ€ ȯ  Date To Ǒ‘“ȡȲ€€ 

 

Time Period ˜™\ͬ’  Time From ˜™ ȯ  Time To ˜™€ 
hrs hrs

(b) Information received at P.S. ȡ“ȡ‡¡ȡȲ Date Ǒ‘“ȡȲ€  Time ˜™ 

Ǘ “ȡĤȡ܏¡Ǖ_   hrs
(c) General Diary Reference Entry No. ĤͪǔçŠ Ȳ  Time ˜™ 
šȪ‡“ȡ˜ ȡ Ȳ‘—[ 
 
hrs

4. Type of Information Ǘ “ȡ€ȡĤ€ȡš Written

System IP ]_”Ȣ  08/05/2023 23:11:47 1/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

5. Place of Occurrence
ƒŠ“ȡ萛 

1. (a) Direction and distance from P.S. ȡ“ȡ ȯ‘ǗšȣkšǑ‘žȡ EAST, 10 Km(s) Beat No. –ȢŠ Ȳ 

(b) Address ”ȡ GURUGRAM,

(c) In case, outside the limit of this Police Station, then Name of P.S. ™Ǒ‘ȡ“ȡ Ȣ˜ȡ€ȯ–ȡ¡š¡ȰȪȡ“ȡ
€ȡ“ȡ˜ 

District (State) ǔ‡›ȡ šȡϙ 

System IP ]_”Ȣ  08/05/2023 23:11:47 2/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

6. Complainant / Informant ͧž€ȡ™€ȡ[ Ǘ “ȡ€ȡ[ 

(a) Name “ȡ˜ ROHIT KUMAR
(b) Father's/Husband's Name ͪ”ȡ”Ǔ€ȡ“ȡ˜ 
(c) Date/Year of Birth ‡Û˜ǓͬŸ[  (d) Nationality šȡçĚȣ™ȡ INDIA

(e) UID No. ™Ǘ]_ŒȢ Ȳ 
(f) Passport No. ”ȡ ”ȪŠ[ Ȳ 

Date of Issue ‡ȡšȣ€š“ȯ€ȧǓͬ  Place of Issue ‡ȡšȣ€š“ȯ€ȡèȡ“ 

(g) Occupation 噝 ȡ™ 

(h) Address
”ȡ 
S.No. Address Type ”ȡ€ȡ Address ”ȡ
Đ Ȳ
Ĥ€ȡš
1 Present Address PLOT NO 119, SECTOR 44, GURGAON SADAR,
GURUGRAM, HARYANA, INDIA
2 Permanent Address PLOT NO 119, SECTOR 44, GURGAON SADAR,
GURUGRAM, HARYANA, INDIA
(i) Phone number ‘Ǘš—ȡŸ Ȳ  Mobile ˜Ȫ–ȡ^› Ȳ 


7. Details of known / suspected / unknown accused with full particulars £ȡ ȲǑ‘Ê’\£ȡ
\ͧ—™Ǖȏ€ȡ”ǗšȯͪšŽ Ǒ¡Ž[“ 

S. No. Name “ȡ˜ Alias `”“ȡ˜ Relative's Name ǐšæȯ‘ȡš€ȡ“ȡ˜

Đ Ȳ 

System IP ]_”Ȣ  08/05/2023 23:11:47 3/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

8. Reasons for delay in reporting by the complainant / informant ͧž€ȡ™€ȡ[ Ǘ “ȡ€ȡ[ɮȡšȡ

ǐš”ȪŠ[‘ȯšȣ ȯ‘‡[€šȡ“ȯ€ȯ€ȡšŽ 

9. Particulars of properties of interest Ȳ–ǔے à”ǔ׏€ȡ

ͪšŽ 
S. No. Property Type à”ǔ׏€ȯSub Type `”Ĥ€ȡš Value(In Rs/-) ˜Ǘã™ ǽ
Đ Ȳ
Ĥ€ȡš ˜Ʌ

10. Total value of property stolen (In Rs/-) Ȫšȣ¡Ǖ_ à”ǔ׏€ȡ€Ǖ›˜Ǘ㙠ǽ˜Ʌ 

11. Inquest Report / U.D. case No., if any ˜ǙיǕ ˜Ȣ¢ȡǐš”ȪŠ[™ǗLŒȢLĤ€šŽ Ȳ™Ǒ‘€Ȫ_¡Ȫ 

S. No. UIDB Number ™ǗLŒȢLĤ€šŽ Ȳ

Đ Ȳ

12. First Information contents Ĥ˜ Ǘ “ȡØ™ 

Dated: 20th July 2022, To, The SHO, Cyber Cell, Gurgaon. Subject: Reporting of a Cyber Security
incident involving unauthorized access of various domains of Policybazaar Insurance Brokers Private
Limited, theft of sensitive Company data including customer data and extortion by CyberX9 (Mr.
Himanshu Pathak, Founder Managing Director) under various provisions of law including Section 66
read with Section 43(a) and (b) of the Information Technology Act, Section 379 Section 383 of the
Indian Penal Code. Respected Sir, 1.We, Policybazaar Insurance Brokers Private Limited
(“We/Policybazaar/Company”), having its registered office address at Plot No. 119, Sector 44,
Gurugram– 122001, Haryana are a registered Insurance Broker with the Insurance Regulatory
Development and Authority of India (IRDAI) and as per the terms of our license We solicit and
arranges insurance business for Our clients with insurance companies. This present complaint is filed
through Rohit Kumar, an authorized representative of Policybazaar having its office address at Plot No.
119, Sector 44, Gurugram– 122001, Haryana and duly authorized to file this Complaint. Attached is the
authorization letter as Annexure A. That on 18th July 2022, the Company received information about
some vulnerabilities in the computer systems and networks of the Company from Himanshu Pathak
([email protected]). Attached is the copy of the email received as Annexure B. That in email
received, CyberX9 (Mr. Himanshu Pathak, Founder Managing Director) shared a report wherein it was
clearly mentioned that they need Bug Bounty as reward for this activity. That since it was random

System IP ]_”Ȣ  08/05/2023 23:11:47 4/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

information, it was brought to the attention of the Company’s IT team. The IT team of the Company
examined and analysed the said information and noted that some elements of the information could
have a technical basis. The IT team also noted that on 18/07/2022, the Company’s systems were
repeatedly targeted by cyberattacks emanating from the IP address 2001:ac8:29:54::a09d,
2a03:1b20:6:f011::a11d, 2a03:1b20:6:f011::a10d, 2001:ac8:20:305::a12d and 193.27.14.67.That it was
only on 19th July 2022 at 1pm that the Company’s IT Department opined that the said information as
mentioned above, could be a Cyber Incident or a Cyber Security incident. Hence, it was only on 19th
July 2022 at 1pm IST when the Company came to know about the above mentioned cyber incident and
cyber security incident which may have taken place as a result of the potential exploration of
vulnerabilities. Consequently, the Company proactively started working to fix the said vulnerabilities.
The Company proactively also reported the cyber security incident to the Director General, Indian
Computer Emergency Response Team (Cert-In), Department of Electronics and Information
Technology, Ministry of Communications and Information Technology of Government of India vide
email on 19th July 2022 itself pursuance to rule 3(1)(l) of the information technology (intermediary
guidelines and digital media ethics code) rules, 2021 read with the notification bearing no. 2(31/2007-
cert-in) vol. iv dated 04/01/2017 and also in compliance with the directions under sub-section (6) of
section 70(b) of the Information Technology Act, 2000 relating to information security practices,
procedure, prevention, response and reporting of cyber incidents for safe trusted internet, issued by the
Indian computer emergency response team (cert-in), ministry of electronics and information technology
(MEITY), Government of India (it directions 2022) dated 28th April, 2022. That a perusal of the
aforesaid facts, along with the perusal of the information received by the Company shows that CyberX9
(Mr. Himanshu Pathak, Founder Managing Director) have unauthorizedly accessed part of Company’s
computer systems and computer network. This is further evident from the fact that the IT systems of
the Company have been dedicatedly targeted by various targeted probing attacks that have been
initiated and implemented on 18th July 2022. That the aforesaid acts of CyberX9 (Mr. Himanshu
Pathak, Founder Managing Director) amount to dedicated cyber-attacks circumventing the cyber
security of a part of the computers, computer systems and computer networks of the Company as also
data resident therein is inclusive of sensitive personal data. That the present cyber security incident
relates to the threat to do as also activities doing the following: i) Targeted scanning/probing of critical
networks/systems, ii) Unauthorised access of IT systems/data, iii) Attack on servers, iv) Attacks on
Application E-Commerce etc. That the Company has already been taking all the steps in its power and
possession so as to protect the security of the said data and its authenticity and veracity. That despite
taking the aforesaid steps, CyberX9 (Mr. Himanshu Pathak, Founder Managing Director) have gone
ahead and unauthorisedly accessed the said data of the Company being sensitive personal data of clients
and customers, dealt, handled, collected and processed by the complainant and resident on its
computers, computer systems and computer networks. That the aforesaid incident is a cyber-incident in
as much as it is a real or suspected adverse event that is likely to cause as well as causes an offence or
contravention, harm to critical functions and services across the private sector, by impairing the
confidentiality, integrity or availability of electronic information, systems, services or networks
resulting in unauthorized access, denial of service or disruption, unauthorized use of a computer
resource, changes to data or information without authorization undermines public confidence, as well as

System IP ]_”Ȣ  08/05/2023 23:11:47 5/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

diminishes the security posture of the nation. That there are sufficient reasons to investigate into the
matter. The complainant company will provide all possible co-operation and information, as and when
required during the course of investigation. In view of the above facts and circumstances and in the
interests of justice, it is, therefore most respectfully prayed that the above cyber security incident is
being reported to you as per the provisions of law and further, you are requested to investigate the
matter and take strictest action against the CyberX9 (Mr. Himanshu Pathak, Founder Managing
Director) as per law. Your Sincerely, Authorized Signatory, Rohit Kumar ,Contact No. 9873997758.
èȡ“ȡ“ȡ ȡ_–šĐȡ_˜‚ǕǽĒȡ˜”šf€ͧž€ȡ™“à–š1882-CAS
Ǒ‘“ȡȲ€ȡ“ȡ”šĤȡ܏¡Ȫ“ȯ”šͧž€ȡ™€ȧĤȡͧ˜€‡ȡȱ  ȯ\”šȡ’’ȡšȡIT
ACT Read with 43(a) 43(b) €ȡƒǑŠ¡Ȫ“ȡ”ȡ™ȡ‡ȡ“ȯ”š`”šȪȏ\ͧ—™Ȫ‚‘‡[šǔ‡ͩ€™ȡ
‡ȡ€šFIR €ȧ€àܙǕŠšȡ_‡ĤǓ™ȡȱȰ™ȡš€š€ȯ`Í \ͬ’€ȡǐš™ɉ€Ȫ_›ȡ€ȡ˜ǔ‡èĚȯŠ€ȧ ȯȡ˜ȯ
—ȯ‡Ȣ‚_¡Ȱ@“€›ͧ˜ ›”Ǖͧ› ˜™\ ›‘šȡ菛ȯ€š˜“Ǔ“šȣ¢€\“Ǖ Ȳ’ȡ“˜ȯå™è¡Ȫȡ
¡Ǘȱ@

13. Action taken: Since the above information reveals commission of offence(s) u/s as
mentioned at Item No. 2.
 €ȧ‚™Ȣ€ȡ™[ȡ¡ȣ ǗȲͩ€`”šȪȏ‡ȡ“€ȡšȣ ȯ”ȡ ›ȡ¡Ȱͩ€\”šȡ’€š“ȯ€ȡšȣ€ȡ
˜‘ Ȳ˜Ʌ`ã›ȯ’ȡšȡ€ȯ¡¡Ȱ 
(1) Registered the case and took up the investigation Ĥ€šŽ‘‡[ͩ€™ȡ‚™ȡkš‡ȡȲ €ȯ
Rank ”‘ 
ͧ›fͧ›™ȡ‚™ȡ JASVIR (I (Inspector)) or ( ™ȡ 
(2) Directed (Name of I.O.) ‡ȡȲ \ͬ’€ȡšȣ€ȡ“ȡ˜ 

No. Ȳ to take up the Investigation €Ȫ‡ȡȲ \”“ȯ”ȡ ˜Ʌ›ȯ“ȯ€ȯͧ›f

Ǔ“‘ȶžǑ‘™ȡ‚™ȡ or ™ȡ

Directed (Mobile No. of I.O.) ‡ȡȲ \ͬ’€ȡšȣ€ȡ˜Ȫ–ȡ^›“Ȳ–š 

(3) Refused investigation due to ‡ȡȲ €ȯͧ›f or €ȯ€ȡšŽ^Ȳ€ȡšͩ€™ȡ

District ǔ«›ȡ 
™ȡ
(4) Transferred to P.S. ȡ“ȡ 

System IP ]_”Ȣ  08/05/2023 23:11:47 6/7

 HARYANA POLICE CITIZEN SERVICES ¡ǐš™ȡŽȡ”Ǖͧ› “ȡ‚ǐš€ ȯȡ
FIRST INFORMATION REPORT
(Under Section 154 Cr.P.C.)
Ĥ˜ Ǘ “ȡǐš”ȪŠ[
 ’ȡšȡ‘ȲŒĤͩЙȡ Ǒ¡Ȳȡ€ȯ¡

on point of jurisdiction €Ȫ¢ȯğȡͬ’€ȡš€ȯ

€ȡšŽ¡èȡȲǐš 
F.I.R. read over to the complainant / informant, admitted to be correctly recorded
and a copy given to the complainant /informant, free of cost. ͧž€ȡ™€ȡ[
Ǘ “ȡ€ȡ[€ȪĤȡͧ˜€ȧ”±€š Ǖ“ȡ_‚™Ȣ ¡ȣ‘‡[¡Ǖ_˜ȡ“ȡkšf€€Ȩ”ȢǓ“žǕã€
ͧž€ȡ™€ȡ[€Ȫ‘ȣ‚™Ȣ

R.O.A.C. ]šjf Ȣ

14. Signature / Thumb Signature of Officer in charge, Police

impression Station ȡ“ȡĤ—ȡšȣ€ȯ¡èȡ¢š
of the complainant /
informant ͧž€ȡ™€ȡ[ Name “ȡ˜ JASVIR
Ǘ “ȡ€ȡ[€ȯ¡èȡ¢š\Ȳ‚Ǘ‹ȯ Rank ”‘ I (Inspector)
€ȡǓ“žȡ“
No. Ȳ RR230

15. Date and time of dispatch to the court \‘ȡ›˜ɅĤȯŸŽ€ȧǑ‘“ȡȲ€

kš ˜™ 

System IP ]_”Ȣ  08/05/2023 23:11:47 7/7