By Anuradha Gandhi, Isha Sharma and Rishabh Gupta
Introduction
It took nothing more than a single unchanged default password- Admin123- to unlock what has now become one of India’s most unsettling episodes of digital exploitation. What initially appeared to be a case of negligence in cybersecurity at Payal Maternity Hospital in Rajkot, Gujarat soon spiralled into a disturbing national scandal, forcing the country to confront a critical question: when women’s intimate moments are secretly filmed, sexualised and circulated online, can such acts be categorized as ‘Sexual Harassment’?
The Rajkot Hospital’s CCTV cameras, left vulnerable due to their default administrative login, were effortlessly breached by hackers. What they accessed was deeply private: hours of footage of women undergoing gynaecological examinations. These illegally acquired recordings-capturing moments of extreme sensitivity and medical vulnerability- were widely circulated and sold on pornographic platforms for monetary gain, thereby, raising questions about digital security, institutional accountability and the legal and ethical rights of women in India.
Inside the Cybercrime Network: From Rajkot to Global Porn Channels
This cybercrime came to light when teaser videos from the Rajkot facility surfaced on YouTube channels such as “Megha Mbbs” and “cp monda”. Viewers of these clips were then lured to Telegram groups, where the complete explicit footage was sold for amounts ranging between INR 700 and INR 4,000.
As the probe deepened, they uncovered a deeply troubling truth: the Rajkot breach was only the tip of the iceberg. Approximately 80 CCTV dashboards across the country had been compromised, extending far beyond hospitals, including in Pune, Mumbai, Nashik, Surat, Ahmedabad, and Delhi, as reported. [1]
Investigators stated that most of the hacked locations had retained the default password for the CCTV dashboard, which was admin123. The hackers used a brute force attack to gain access to the system, using combinations of words, numbers and symbols. The default password being retained made the job easy.[2]
Violation of Legal Rights and Safety
This incident has exposed the gaps in policy, compliance, and enforcement relevant not only in terms of gender justice but also in the protection of fundamental rights, technological accountability and medical ethics.[3]
Breach of Fundamental Rights: The unauthorized recording, accessing and circulation of intimate footage constitutes a direct violation of the Right to Privacy, recognized as a fundamental right under Article 21 of the Indian Constitution
Breach of the Information Technology Act, 2000: Several provisions of the IT Act were triggered:
- Section 43A- The failure of the hospital to change the default password is a textbook example of negligent data protection.
- Section 66E- Punishes intentional or knowingly violation of privacy by capturing, publishing or transmitting images of a person’s private area without consent.
- Section 72-Penalises breach of confidentiality and privacy arising from unauthorized access or disclosure.
The conduct also attracts Criminal Offences under the Bharatiya Nyaya Sanhita (BNS):
- Section 77 (Voyeurism)- For acts amounting to criminal intrusion, including non-consensual recording and distribution of women engaged in private acts
- Section 79-For outraging the modesty of a woman
Another distressing aspect of the incident is the breach of Medical Council of India (MCI) Code of Ethics Regulations: Mandates patient confidentiality and dignified treatment by healthcare providers.
Sexual Harassment in the Digital Sphere: Beyond Physical Contact
The Rajkot CCTV breach is not only a case involving violation of privacy, failure of data protection and institutional negligence- it is also a powerful reminder that sexual harassment today is not just confined to physical proximity, touch or direct advances. It has firmly entered the digital sphere, where technology becomes a tool for sexual intrusion.
Acts that involve capturing, viewing and circulating a woman’s intimate body without consent shall constitute sexual harassment, even if no physical contact occurs.
As the definition of sexual harassment includes any or all of the following acts:
- Physical contact and advances involving unwelcome and explicit sexual overtures; or
- A demand or request for sexual favours.
- Showing pornography against the will of a woman; or
- Making sexually coloured remarks
The concerned Rajkot incident exemplifies this expanded understanding
- Women’s intimate bodies were viewed without consent
- Their private moments were turned into sexual content
- Their dignity was violated for monetary gain
- Their vulnerability was exploited and distributed globally
This is what we may term as sexual harassment in its digital form: cyber-sexual harassment
The judicial precent that reinforces this understanding is the ruling in the case of Sudhir Kumar vs. the State of NCT of Delhi, 2025 wherein the court clarified an essential principle that dissemination of intimate images, even if it was in a consensual relationship, it shall be construed a grave violation of dignity and privacy.
Deepfakes and Data Privacy
With the growing deployment of CCTV networks, the rise of non-consensual imagery or deepfakes pornography can be traced to the increasing availability of visual and audio data that can easily serve as a source material for manipulation. Deepfake technology uses Artificial Intelligence (hereinafter referred to as “AI”) to create highly realistic and convincing fake videos, images and audio recording posing serious risks such as privacy breaches, disinformation and social engineering attacks[4]. Such footage and deepfakes often contain sensitive personal data that can identify individuals (particularly women) including facial biometrics, voice recordings and real-time tracking of such individuals.
The K.S. Puttaswamy judgment which brought right to privacy as a fundamental right under Article 21 of the Constitution also addressed the concept of Reasonable Expectation of Privacy in intimate spaces such as gynecology wards in a hospital vicinity. The court ruled that such expectation of privacy is not only confined to intimate spaces such as bedroom or washroom, but also includes public places as well, and such privacy is not lost merely because an individual is in a public place[5].
The existing Information Technology Act, 2000 and the Bharatiya Nyay Sanhita, 2023 penalizes cybercrimes or computer-generated crimes which includes deepfakes. Furthermore, the Digital Personal Data Protection Act, 2023 which mandates Data Fiduciaries (hospitals in this case) to implement reasonable security safeguards to protection personal information imposes a penalty of upto 250 crores on failure to fulfill such compliance.
To read more on how Deepfakes and AI generated images are regulated, please refer our article available at: https://ssrana.in/articles/ai-and-deepfakes-navigating-the-digital-revolution-and-its-dark-side/
Conclusion
In conclusion, the Gujarat hospital footage leak is not just a cybercrime but a grave violation of constitutional freedoms and gender justice. It calls for sweeping reforms in institutional accountability, stronger cybersecurity protocols, regular audits, and public awareness campaigns. For the usage of CCTV images, a warning sign showing the relevant information in a clearly readable manner must be displayed publicly at a place to the individuals, for example as a complete information sheet available at a central location such as at reception or information desk. Only through vigilant compliance and respect for patient dignity can trust in medical institutions be restored and future violations prevented.
[4] https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0060
[5] Chandrachud, J, at para 3(f), J. Bobde at para 22, K.S. Puttaswamy v. Union of India