Someone Stole Your API Credentials: A Step-by-Step Legal Roadmap Under Indian Law

Your API bill just shot up ?80,000 overnight.

You didn't make those calls. You didn't authorise a single one. But someone did  using your credentials. Now you're staring at a bill you never generated, a service that's potentially compromised and zero idea what to do next.

Here's what most developers and businesses don't know: API key theft and misuse is not just a technical headache. It is a prosecutable cybercrime under Indian law. And there is a step-by-step legal path you can take right now.

First, Understand What You're Actually Dealing With Legally

Before running to the police station, understand the legal character of what happened. API key theft typically involves one or more of the following:

Unauthorised access to a computer system or network. Under the Bharatiya Nyaya Sanhita (BNS) 2023 and the Information Technology Act 2000, accessing a system without permission is not a grey zone  it is a statutory offence.

Identity fraud and impersonation. When someone uses your API key to make requests, they are impersonating your identity to a third-party service. That is fraud.

Theft of a digital resource. API keys are access credentials with economic value. Courts have increasingly recognised digital credentials as property capable of being stolen.

Data breach. If the attacker accessed more than just the key logs, user data, internal endpoints  your exposure widens under the DPDP Act 2023 as well.

Knowing which category applies to your situation determines which sections you invoke, which forum you approach and how strong your case is.

Step 1 — Stop the Bleeding (Immediate Technical Actions)

Before any legal step, take these technical actions immediately. They also double as evidence preservation, which your lawyer will thank you for later.

Revoke and rotate the compromised key. Log into your API provider dashboard and revoke the stolen key immediately. Issue a new one and restrict it with IP whitelisting and rate limits.

Download all access logs. Pull complete logs from your API provider  timestamps, IP addresses, request volumes, geographic locations of calls. This is your primary evidence. Export it in raw format (JSON/CSV) and preserve it across multiple locations.

Preserve billing records. Screenshot and download every anomalous billing statement. Courts need to see the financial harm in documentary form.

Run an internal audit. Identify where the key was stored (environment variable, GitHub repo, hardcoded in frontend, third-party integration). This determines whether the breach was external or internal  which matters for liability.

Engage your API provider. Most major providers (Anthropic, OpenAI, Google, AWS) have abuse response teams. File a report with them. Ask for their internal logs and any information they can share about the abusing endpoint. Some will cooperate with law enforcement formally.

The golden rule of Indian cybercrime litigation: courts reward those who preserve evidence early. A party who can produce timestamped logs, billing anomalies and technical audit trails has a fundamentally stronger case than one who cannot.

Step 2 — File a Complaint with the Cybercrime Cell - 1930

India has a dedicated cybercrime reporting infrastructure. Use it.

National Cybercrime Reporting Portal

Go to cybercrime.gov.in and file an online complaint under "Financial Cyber Frauds" or "Other Cyber Crimes" as appropriate. You will receive a complaint acknowledgement number. This is your official entry point into the system.

This portal is operated under the Ministry of Home Affairs and routes complaints to the appropriate state cybercrime unit. Filing here also creates an official timestamp for your complaint  important if the accused later claims they stopped the misuse before you reported it.

File an FIR at the Cybercrime Police Station

An online complaint alone is not a First Information Report (FIR). Under the Supreme Court's ruling in Lalita Kumari v. Govt. of UP (2014), police are mandatorily required to register an FIR if the complaint discloses a cognizable offence. API misuse under the IT Act qualifies.

Go to the nearest police station or, preferably, the dedicated Cybercrime Police Station in your city. Every major city  Delhi, Mumbai, Bengaluru, Chennai, Hyderabad  has one. File a written complaint and insist on an FIR. If police refuse, you have two options:

First, approach the Superintendent of Police (SP) with a written complaint under Section 173 BNSS (formerly S.154(3) CrPC). Second, file a complaint directly before the concerned Magistrate under Section 175 BNSS (formerly S.156(3) CrPC) and ask the Magistrate to order the police to register an FIR.

Do not leave the station without a copy of the FIR or at minimum a written acknowledgement of your complaint. A complaint without an FIR number gives you no traction.

Step 3 - Know the Legal Sections to Invoke

The following statutory provisions are your primary weapons. Cite them explicitly in your FIR.

Under the Information Technology Act 2000

Section 43  Penalty for damage to computer, computer system or network. This covers unauthorised access and data theft. It is a civil remedy provision allowing compensation up to ?5 crore (adjudication via the IT Adjudicating Officer) without requiring criminal prosecution.

Section 66  Computer-related offences (criminal). This is the criminal cousin of S.43. Where the act in S.43 is done dishonestly or fraudulently, it becomes punishable with imprisonment up to 3 years and/or fine up to ?5 lakh. This is your primary criminal hook.

Section 66C  Identity theft. Using another person's electronic signature, password or unique identification feature fraudulently. An API key is a "unique identification feature." This carries imprisonment up to 3 years and fine up to ?1 lakh. Do not miss this section  it is precisely crafted for credential theft.

Section 66D  Cheating by personation using a computer resource. If the attacker used your key to receive services or financial benefits by impersonating you, this section applies. Punishment: up to 3 years imprisonment and fine up to ?1 lakh.

Section 72  Breach of confidentiality and privacy. If an insider employee, contractor, service provider accessed and leaked your API key, this section applies specifically to persons who obtained access in the course of a legitimate function.

Under the Bharatiya Nyaya Sanhita (BNS) 2023

Section 318 BNS (formerly S.420 IPC  Cheating) If the attacker induced any payment, service or resource through deception using your credentials, cheating is made out.

Section 303 BNS (formerly S.378/379 IPC Theft) The application of theft to intangible digital property has evolved in Indian jurisprudence. While traditionally applicable to movable tangible property, courts have accepted that access credentials with economic value can constitute the subject matter of dishonest appropriation in conjunction with other offences.

Section 308 BNS (Extortion)  Relevant if the attacker threatened to expose your data or continue the abuse unless paid.

Section 61 BNS (Criminal Conspiracy) If multiple actors were involved, rope in this section. It allows prosecution of all co-conspirators even if each played a limited role.

Under Other Statutes

Digital Personal Data Protection Act 2023 (DPDPA) If the breach exposed personal data of your users, you have notification and compliance obligations as a Data Fiduciary. The Data Protection Board of India (once constituted) will have adjudicatory jurisdiction. Non-compliance attracts penalties up to ?250 crore.

Indian Contract Act 1872  If the attacker was a vendor, contractor or third-party integration partner who violated their service agreement, you have a civil suit for breach of contract in addition to criminal action.

Step 4  Approach the IT Adjudicating Officer for Compensation

This is the most underused remedy in Indian cybercrime law.

Every state has an IT Adjudicating Officer appointed under Section 46 of the IT Act. This officer has jurisdiction to adjudicate claims under Sections 43, 43A and 44 of the IT Act and can award compensation up to ?5 crore.

This is a civil, quasi-judicial remedy that runs parallel to criminal prosecution you can pursue both simultaneously. The standard of proof is lower than criminal courts (preponderance of probability versus beyond reasonable doubt). You need to demonstrate:

1. That the respondent accessed your system without authorisation.
2. That damage resulted  financial, data-related or reputational.
3. Quantum of loss with supporting documents.

File your application before the Adjudicating Officer of the state where your business is registered or where the servers are located. Attach your FIR copy, billing records, technical logs and a CA certificate of financial loss where possible.

This route is often faster than criminal courts and can result in monetary compensation even if criminal conviction is difficult to secure.

Step 5  File a Civil Suit for Damages

Simultaneously, you can file a civil suit in a civil court of competent jurisdiction for:

Damages under the Law of Torts, specifically for the tort of trespass to chattels (unauthorised interference with your digital property) and the tort of conversion.

Permanent injunction restraining the defendant from further use of your credentials or systems, under Order 39 CPC.

Account of profits  if the attacker profited from using your API (running a for-profit service on your key, selling access, etc.), you can ask the court to order them to account for and disgorge those profits.

Anton Piller orders (search orders)  In urgent cases where evidence is at risk of being destroyed, you can seek an ex parte order from the court for a search of the defendant's premises or systems. This is a drastic remedy and courts grant it sparingly, but it exists.

The civil suit is your best vehicle for proportionate financial recovery, particularly where criminal prosecution is slow or where the identity of the attacker is known through IP tracing or linked accounts.

Step 6  If the Attacker Is Abroad

Cross-border API misuse is common. A key leaked on GitHub can be scraped and abused by someone in another country within hours.

The picture is harder but not hopeless.

INTERPOL / Mutual Legal Assistance Treaties (MLATs): India has MLATs with several countries. Once an FIR is registered and investigated, the cybercrime unit can formally request data from foreign jurisdictions via MLAT and through INTERPOL channels.

Approach the API Provider Directly: Major API providers in foreign jurisdictions are often subject to subpoenas and legal process in their home countries. Your Indian lawyer can coordinate with counsel abroad to serve legal process on the provider for subscriber information linked to the abusing account.

File with CERT-In: India's Computer Emergency Response Team (CERT-In) handles cross-border cybersecurity incidents. A formal complaint to CERT-In at cert-in.org.in supplements your legal filing and can trigger official inter-government communication.

Claim against the API Provider: If the provider's negligence contributed to the key exposure (poor security, inadequate rate-limiting, failure to flag anomalous usage), explore whether a claim lies against them in their home jurisdiction. This is fact-dependent and requires foreign counsel.

Step 7  The Insider Threat: When It's Someone You Know

A significant portion of API key theft is internal  a disgruntled employee, a former contractor, a careless developer who hardcoded credentials in a public repository.

For insider threats, the legal approach shifts:

S.72 IT Act specifically addresses breach of confidentiality by persons who accessed data in the course of their powers or duties. This covers employees and service providers directly.

Employment law remedies: If the offender was an employee, simultaneously pursue action under their employment contract  breach of confidentiality clause, breach of fiduciary duty. A civil suit for breach of contract runs alongside the criminal case.

Forensic investigation first: Before any confrontation, engage a digital forensics firm to secure evidence from company systems. Once an insider knows they are under investigation, evidence can disappear fast.

Do not issue a show-cause notice before the forensic audit is complete. This is a common mistake. The moment the insider knows you know, they may wipe logs, destroy devices or flee. Secure the evidence first. Then act.

Building Your Evidence File: A Practical Checklist

Courts move on documents. Before you approach any forum, compile:

• Full API access logs with timestamps (export in raw format from your provider)
• Billing statements showing pre-breach and post-breach usage delta
• Screenshots of the compromised key's last authorised use
• Any GitHub, GitLab or other repository where the key may have been exposed (with commit history)
• IP addresses of the abusing requests (from logs)
• Communication records Slack messages, emails, WhatsApp chats if an insider is involved
• Forensic report from a CERT-In empanelled security auditor (this carries weight in court)
• CA-certified computation of financial loss (for compensation claims)
• Written correspondence with your API provider including their abuse report response

Preserve all of this in multiple physical and cloud backups before filing. Courts cannot act on evidence that no longer exists.

The Timeline You Should Expect

Indian legal proceedings are not fast. Realistic expectations:

FIR and cybercrime investigation: 3 to 18 months depending on jurisdiction and complexity. Cybercrime cells in metro cities (Delhi, Bengaluru) are better resourced than others.

IT Adjudicating Officer proceedings: 6 months to 2 years for a full hearing and order.

Civil suit: 2 to 5 years in most civil courts, though commercial disputes above ?3 lakh can go to the Commercial Courts under the Commercial Courts Act 2015, which has faster timelines and stricter case management.

Bail and interim relief: If the accused is identified and arrested, bail hearings happen within days. You can oppose bail if you have evidence of likely tampering.

Use this timeline to set expectations not to be deterred. Every legal action you take also creates an official record that protects you against future liability (e.g., if a regulator later asks why you didn't act on the breach).

A Note on Prevention That Courts Will Also Notice

Courts and adjudicating officers assess the conduct of the claimant too. If you stored your API key in a public GitHub repository or transmitted it over unencrypted channels, this may be raised as contributory negligence.

Protect yourself legally by protecting yourself technically:

• Never commit API keys to version control. Use environment variables and secret management tools.
• Enable IP restriction and rate limiting on all API credentials.
• Rotate keys on a regular schedule and immediately after any team member departure.
• Maintain access audit logs internally do not rely solely on your provider's logs.
• Use a secrets scanning tool (like GitGuardian or Trufflehog) to catch accidental exposures before they become breaches.

This is not just good security practice. It is evidence that you exercised reasonable care which strengthens your legal position significantly.

Final Word: Don't Wait

The Limitation Act 1963 applies to civil claims. Under Section 43 IT Act read with limitation principles, your window to initiate legal proceedings is generally three years from the date you discovered or ought to have discovered the breach.

Criminal cases do not strictly attract limitation in the same way for serious offences, but delay weakens evidence, makes witnesses unavailable and signals lack of seriousness to courts.

If your API key has been compromised, the clock is already running.

Revoke the key. Preserve the logs. File the complaint. Get a cybercrime lawyer on call.

The law is on your side but only if you act.

This blog provides general legal information under Indian law and does not constitute formal legal advice or create an advocate-client relationship. For advice specific to your situation, consult a practising advocate with expertise in cybercrime and IT law.