Trellix Confirms Source Code Breach: Understanding Repository Access Threats, Indian Cyber Law, and Remedies

The Incident: Trellix and Unauthorized Repository Access

Global cybersecurity giant Trellix recently confirmed an incident involving unauthorized access to an internal source code repository. While the company moved quickly to state that customer environments and core security products remained protected from direct compromise, incidents of this nature send ripples across the technology and security sectors. When a cybersecurity vendor's own source code is accessed without authorization, it highlights an uncomfortable reality: no enterprise is immune to credential compromise, third-party supply chain vulnerabilities, or repository misconfigurations.

For businesses, software developers, and legal practitioners in India, this incident serves as an urgent case study in digital asset protection, software supply chain vulnerability, and the evolving statutory duties under Indian law.

---

Deconstructing the Threat: Why Source Code Breaches Matter

Source code is the intellectual lifeblood of any software or technology enterprise. Unlike structured customer databases, which often contain identifiable personal data, source code repositories contain:

• Proprietary Algorithms and Architectural Logic: The core intellectual property and competitive trade secrets of the enterprise.
• Vulnerability Roadmaps: Exposing code to bad actors allows them to conduct static and dynamic code analysis at leisure, uncovering zero-day vulnerabilities or logic flaws before patches can be developed.
• Embedded Secrets and Credentials: Repositories often inadvertently contain hardcoded API keys, cryptographic tokens, database connection strings, or cloud access management credentials.
• Supply Chain Infiltration Vectors: Unauthorized repository access creates opportunities for adversaries to attempt malicious code injection, potentially weaponizing software updates distributed to thousands of downstream clients.

When a repository is breached, the primary risk is rarely just the loss of confidentiality—it is the downstream exploit potential that threatens enterprise clients relying on that software ecosystem.

---

The Indian Legal Framework Governing Source Code Theft

In India, the unauthorized accessing, copying, or exfiltration of proprietary source code triggers overlapping liabilities under specialized cyber legislation, substantive criminal law, and intellectual property statutes.

1. Information Technology Act, 2000 (IT Act)

The IT Act remains the cornerstone for prosecuting unauthorized digital access and data theft:

• Section 43 (Penalty and Compensation for Damage to Computer Systems): Imposes civil liability for unauthorized access, downloading, extraction, or copying of data or computer source code, along with disrupting systems or introducing contaminants.
• Section 66 (Computer-Related Offences): Converts acts under Section 43 into cognizable criminal offences if committed dishonestly or fraudulently, punishable with imprisonment of up to three years or a fine of up to five lakh rupees, or both.
• Section 66B: Penalizes dishonestly receiving or retaining stolen computer resources or communication devices.
• Section 66C and 66D: Deal with identity theft (misuse of stolen credentials, SSH keys, or access tokens) and cheating by personation using a computer resource.
• Section 72A: Penalizes disclosure of information in breach of a lawful contract, carrying imprisonment of up to three years or a fine up to five lakh rupees.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

With the replacement of the Indian Penal Code (IPC) by the Bharatiya Nyaya Sanhita, 2023, cyber theft and breach of trust are prosecuted under modernized provisions:

• Section 303 (Theft): Applies to the dishonest removal of movable property. Courts in India have consistently recognized electronic data and source code stored on storage media as property subject to theft.
• Section 316 (Criminal Breach of Trust): Where employees, contractors, or repository service providers with entrusted access dishonestly misappropriate or convert source code to their own use.
• Section 318 (Cheating): Applicable where unauthorized access was procured through fraudulent misrepresentation or spoofed credentials.
• Section 61 (Criminal Conspiracy): Invoked where multiple actors collaborate to infiltrate digital systems or traffic in exfiltrated proprietary assets.

3. CERT-In Mandatory Reporting Directives

Under the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the IT Act, organizations in India are legally mandated to report cybersecurity incidents—including unauthorized access to systems or data breaches—within six hours of noticing or being notified of the event.

---

Digital Evidence and the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Investigating and prosecuting repository breaches requires strict preservation of digital evidence. Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaces the Indian Evidence Act, the admissibility of electronic records is governed by Section 63 (analogous to the former Section 65B).

To ensure audit logs, Git commit histories, cloud identity logs (such as IAM access records), and IP tracebacks are admissible in an Indian court:

1. Chain of Custody: Forensic images of compromised servers or developer endpoints must be created and hashed immediately.
2. Section 63 Certificate: An electronic record certificate signed by an authorized person occupying an official position responsible for managing the relevant computer resource must accompany the logs.
3. Third-Party Preservation: Requests must be formally issued to hosting platforms (e.g., GitHub, GitLab, AWS) to preserve access logs before rolling retention policies overwrite them.

---

Step-by-Step Reporting Guide for Victims in Mumbai, Thane, and Mira Road

If an Indian software firm or technology company in the Mumbai Metropolitan Region suffers an unauthorized repository intrusion or intellectual property breach, immediate technical containment must be paired with formal legal reporting.

1. File a Complaint on the National Cyber Crime Reporting Portal

Submit a comprehensive complaint via cybercrime.gov.in under the "Cyber Crime against Business Entities" category. Ensure you upload:

• System and identity access logs,
• Timestamped evidence of unauthorized access,
• An executive summary of impacted repositories,
• Details of suspected IP addresses or compromised credentials.

2. Approaching Local Cyber Police Jurisdictions

In Maharashtra, cyber offences involving significant intellectual property theft, corporate hacking, or financial loss are handled by specialized cyber police stations:

• Mumbai Jurisdiction: File your complaint with the Nodal Cyber Police Station, Bandra-Kurla Complex (BKC), or the respective Regional Cyber Police Stations (e.g., South Region at Worli, Western Region at BKC, North Region at Kandivali).
• Thane Jurisdiction: Approach the Thane Cyber Crime Cell, located near the Commissioner of Police Office or Wagle Estate Cyber Police Station, submitting a formal written application under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) for registration of an FIR.
• Mira-Bhayandar, Vasai-Virar (MBVV) Jurisdiction: For businesses and startups operating across Mira Road or Bhayandar, approach the MBVV Police Cyber Crime Cell located at Kashimira / Commissionerate headquarters to initiate an investigation.

3. Pursuing Civil and Commercial Remedies

In parallel with criminal proceedings, affected entities can institute commercial suits before the High Court of Bombay or relevant Commercial Courts under the Commercial Courts Act, 2015, seeking:

• Ex-parte Ad Interim Injunctions: Restraining the accused or unknown third parties (John Doe / Ashok Kumar orders) from circulating, publishing, or selling the leaked code.
• Damages and Anton Piller Orders: Enabling court-appointed commissioners to search premises and seize devices harboring stolen source code.

---

Frequently Asked Questions (FAQs)

Is proprietary software source code protected as a trade secret in India?

Yes. While India does not have a standalone Trade Secrets Act, source code is vigorously protected through common law remedies against breach of confidence, contractual non-disclosure agreements (NDAs), and under the Copyright Act, 1957, which defines "computer programme" as a literary work under Section 2(o).

What immediate steps should a company take if an employee exfiltrates code?

Immediately revoke access credentials across all cloud infrastructure, issue an internal legal hold on all communication channels and devices used by the employee, conduct a forensically sound drive extraction, file an incident report with CERT-In if threshold events are met, and issue a formal cease-and-desist notice alongside lodging a complaint under the IT Act and Section 316 of the BNS.

Can Indian victims seek disclosure orders against foreign-hosted repository platforms?

Yes. Through appropriate mutual legal assistance requests or court-directed summons/notices served on Indian nodal officers of multinational intermediaries (under the Information Technology Intermediary Guidelines), victims can seek IP access records, login timestamps, and account deletion.

---

Safeguarding Your Intellectual Property with APS Law

Navigating source code theft, internal data leaks, or unauthorized infrastructure access demands a swift, multi-pronged approach combining incident containment, forensic integrity, and robust legal recourse.

APS Law assists corporate clients, startups, and technology entities across Mumbai, Thane, and Mira Road in handling cyber incident responses, filing corporate cybercrime complaints, and securing urgent civil relief for intellectual property violations.

If your enterprise is dealing with unauthorized access, an internal leak, or cyber compliance issues, contact APS Law today to schedule a confidential legal consultation.