“How Gujarat hospital footage ended up on porn market,”

A disturbing cyber breach at a Gujarat hospital exposed sensitive medical privacy, with CCTV footage of women undergoing gynecological examinations at Rajkot’s Payal Maternity Hospital hacked and spread on international porn networks. This unprecedented violation, tied to a default password vulnerability, highlights urgent gaps in healthcare data security and patient confidentiality in India.

Horrific Privacy Breach at Gujarat Hospital

In early 2024 through late 2024, hackers accessed the CCTV system of Payal Maternity Hospital in Rajkot using the default password “admin123.” They recorded and stole hours of intimate footage of women being examined in the gynecology ward. At least 50,000 clips were hacked over nine months not just from this hospital but from approximately 80 different CCTV dashboards nationwide, including cities like Pune, Mumbai, Nashik, Ahmedabad, and Delhi.

The stolen videos were posted as teasers on YouTube channels such as “Megha Mbbs” and were used to direct viewers to subscription-based Telegram groups, where the footage was sold for prices ranging between Rs 700 and Rs 4,000 per video. The scam affected women across 20 states, spanning hospitals, schools, offices, cinemas, factories, and residential places.​

Expert Perspectives on Medical Privacy and Security Risks

Data privacy experts emphasize that the ease of gaining access through default or weak passwords is a critical cybersecurity failure. According to health data privacy specialists in India, hospitals must prioritize strong encryption, access controls, and regular password changes to protect sensitive data. Experts also point to a regulatory gap in enforcing patient data protection in private health facilities.​

 A cybersecurity consultant involved in healthcare systems, told this reporter, “This incident starkly highlights how healthcare facilities are prime targets for cybercriminals. Patient safety extends beyond physical care to securing digital infrastructure containing highly sensitive information. Hospitals must adopt robust information governance and staff training on cybersecurity best practices” (expert interview).

Context: Privacy Norms and Indian Healthcare Data Protection Laws

In India, laws such as the Information Technology Act sections 66E and 67 address privacy violation and obscene material transmission. However, comprehensive data protection legislation, including digital health privacy norms, is evolving. The Digital Personal Data Protection (DPDP) Rules 2025, soon to be effective, aim to regulate handling of sensitive personal data, including health information, to build trust in the digital health ecosystem.​

Despite these frameworks, enforcement challenges persist in private hospitals and smaller clinics, many lacking awareness or resources to implement cybersecurity measures effectively. Public hospitals typically avoid CCTV in patient care areas to protect privacy, but private clinics like Payal Maternity Hospital have faced criticism for inadequate safeguards.​

Public Health Implications and Patient Trust

This breach severely undermines patient trust, a foundation of effective healthcare. The fear of voyeuristic misuse of medical footage can deter women and others from seeking necessary medical care, especially in sensitive specialties like gynecology. The emotional and psychological trauma inflicted on victims of such privacy breaches is profound and demands recognition and support from the healthcare system and authorities.

Healthcare providers must maintain confidentiality standards to ensure patients feel safe in sharing personal information and undergoing examinations. As India’s healthcare sector rapidly digitizes, safeguarding electronic health data through stringent security practices is essential to protect public health interests.​

Limitations and Counterarguments

While the investigation led to arrests of perpetrators operating from India and abroad, authorities note that cybercriminals’ use of VPNs complicates tracing and complete dismantling of such networks. Some critics argue that the hospital bears significant responsibility for failing to change default passwords and securing its systems. The digital divide and lack of cybersecurity literacy among smaller healthcare institutions present ongoing systemic vulnerabilities.

What This Means for Patients and Healthcare Institutions

Patients should be aware of their rights to privacy and inquire about data protection policies at healthcare facilities. Hospitals must audit and strengthen their IT infrastructure, avoid default passwords, implement real-time monitoring of CCTV and digital systems, and train staff rigorously on cybersecurity.

Policy makers should expedite implementation of robust health data privacy regulations and ensure continuous oversight. Public awareness campaigns can educate persons about digital privacy risks in healthcare settings.

Medical Disclaimer: This article is for informational purposes only and should not be considered medical advice. Always consult with qualified healthcare professionals before making any health-related decisions or changes to your treatment plan. The information presented here is based on current research and expert opinions, which may evolve as new evidence emerges.

References​