Mphasis, ex-employee spar in court over CEO impersonation, whistleblower claims-OxBig News Network

The Indian information technology (IT) services company filed a complaint against Albert Rojas in a New York district court on 16 April for digitally impersonating chief executive Nitin Rakesh and threatening another employee, as well as allegedly disclosing proprietary information via duplicate websites.

Rojas, who was a client technical specialist with Mphasis in the US, has denied the charges. In his reply to the court on 10 June, Rojas stated that he created duplicate websites to make the public aware of Mphasis’s alleged cyber lapses, and so his actions were “protected whistleblower activity” and permissible by law. No business was transacted through the duplicate websites, he said.

However, on 15 June, Mphasis’s counsel filed a second complaint with the New York court alleging that Rojas had violated the court’s 9 June order as his duplicate website with a URL resembling the company’s was still active.

The court had on 6 May passed a temporary restraining order prohibiting Rojas from accessing and disclosing any company-specific confidential information. On 9 June, it passed a preliminary injunction order reiterating its restraining order and prohibiting Rojas from contacting Mphasis employees he had worked with.

Also read | Infosys-Cognizant trade-secrets battle nears end as Dallas court passes order

Mphasis had terminated Rojas’s employment in March, accusing him of stealing proprietary company and client-related information from a company-issued laptop and transferring data to his personal systems without authorisation. It also issued a cease-and-desist notice asking him to return the laptop and sought clarity on third parties with whom he had shared company-specific information.

On 16 April, the Blackstone-owned company approached the New York district court complaining that Rojas was misleading clients through his actions and that he had threatened one of its employees.

“On April 4, 2025, Rojas sent a threatening email to Waghmode from his spoof email “[email protected],” stating that he would be back in New York City “next week” and if he caught Waghmode “on the street,” he was “legally obligated to kick [Waghmode’s] ass for that Friday the 28th nonsense you pulled,” Mphasis said in its court complaint.

Mint could not ascertain details on Waghmode’s identity or the incident mentioned in Mphasis’s complaint.

The genesis

Mphasis said in its lawsuit filed in April that “on February 28, 2025, despite being warned against doing so, Rojas forwarded confidential and proprietary information to his personal email addresses,…., in the form of a PowerPoint presentation prepared for Mphasis’ client, QBE”.

QBE Insurance Group Ltd is a Sydney-based company that last year reported a data breach of sensitive personal and protected health information of an undetermined number of individuals.

Mphasis said it immediately locked Rojas’s account due to multiple security breaches and at the conclusion of an investigation into his repeated violations, terminated his employment in March.

The Bengaluru-based company said Rojas also shared confidential files and presentations with colleagues not involved in the privacy breach investigation against him, adding that this too was a violation of the company’s policies.

Mphasis said Rojas did this despite signing documents prohibiting him from sending client-specific data to his personal systems and email as that could result in data loss.

Rojas, in his reply to the New York court on 10 June, said Mphasis had declined to issue him a company laptop and that he had to use a laptop issued by QBE, which he claimed had technical difficulties.

The technical glitches, he said, prompted him to use his personal system because the QBE-issued laptop allowed him access to both Mphasis and QBE networks. 

Rojas added that this dual access would cause cyber issues and expose confidential information to multiple users in addition to a blue screen, which is an error screen displayed on the monitor which leads to the system crashing down.

“Mphasis’s failure to provision standard infrastructure (e.g., domain-joined laptop, VPN) rendered compliance impossible, while its selective policy enforcement and retaliation underscore inequitable conduct barring relief,” Rojas said in his reply to the court.

Also read | Mid-cap outperform larger peers yet again, threaten to eat their lunch

Charges and countercharges

Mphasis informed the court that after Rojas’s employment was terminated he created an unauthorized website containing disparaging information about the company using Mphasis’s letterhead between 12 and 15 March.

Mphasis said that Rojas’s duplicate website used the company’s trademark and logo and he forwarded the website to employees of Mphasis using a “spoof” email address impersonating its chief executive.

“Rojas removed Mphasis proprietary information from authorized company equipment and published the information on the website,” Mphasis said in its first court complaint. 

Rojas, in his response to the court on 10 June, said his actions were within whistleblower permits as they were meant to make the public aware of Mphasis’s alleged cyber lapses, which he claims he had brought up with the company’s management on several occasions.

“These websites were noncommercial, intended solely for public-interest disclosure, and contained clear disclaimers, including: “This is not an official Mphasis site. This site contains protected disclosures made pursuant to NYLL § 740 and other applicable laws. All information shared is for documentation, research, and public accountability.”,” Rojas said in his reply to the court.

“Defendant launched these sites only after Mphasis terminated his employment and ignored his multiple internal escalations, including formal complaints to the Ethics and Compliance Office and Whistleblower channels, regarding serious governance and security failures,” Rojas said. 

He added that his use of the company logo and name should be classified as “nominative fair use and parody”.

Also read | IT companies are hunting deals rather than waiting for clients to float tenders

In additional responses to the court on 16 June, Rojas said the duplicate website address using Mphasis in its name now directs to a different website.

“As of June 16, 2025, the domain Mphasis.cloud has been fully purged of content and now redirects to QBE.world, which does not use the word “Mphasis” in its domain name or in any disparaging manner,” he said, adding that he had not stolen any proprietary information.

“The core “trade secret” I allegedly misappropriated is not proprietary code—it is the truth about a broken security process where two large offshore entities allowed credential puddle-jumping across systems, then shifted blame to a single individual,” said Rojas, adding that the laptop had not been deactivated and that “Mphasis retained a private investigator to track my location and intervene outside normal return protocols”.

The court trail

The New York district court, as part of its temporary restraining order issued on 6 May, prohibited Rojas from “using any email addresses impersonating Mphasis CEO Nitin Rakesh or an employee of Mphasis, including creating email domain names resembling that of Mphasis, its employees, or its Legal Department”.

Judge Jesse M. Furman also asked Mphasis to facilitate the return of the laptop and ordered for a forensic examination of Rojas’s personal accounts.

“Rojas shall cooperate in full with Mphasis’ counsel to arrange for a neutral forensic examiner selected by Mphasis to conduct an immediate forensic examination of Rojas’ personal Mac computer, including all email accounts, cloud accounts, and other relevant software/hardware utilized by Rojas since March 13, 2025,” the court said in its May order.

In its preliminary injunction order issued on 9 June, the court reiterated its temporary order and prohibited Rojas from contacting Mphasis’s employees or clients.

“Rojas shall cease contacting the client of Mphasis for whom he created content while employed by Mphasis, QBE, and its employees,” Judge Furman said in his order. “Rojas shall remove any websites using Mphasis in the domain name and cease creating websites disparaging Mphasis.”

Also read | Bosses of India’s top three IT firms flag macroeconomic concerns

Mphasis approached the court again on 15 June complaining that Rojas had violated the 9 June order.

“I am writing to put the Court on notice that Defendant has violated the Preliminary Injunction dated June 9, 2025 (“PI”) by disparaging Mphasis on Mphasis.cloud. Plaintiff requests an Order ordering monetary sanctions against Defendant for Defendant’s multiple violations of the temporary restraining order (“TRO”) and the PI,” said Kimberly Karseboom, counsel at Ogletree Deakins, which is the law firm representing Mphasis.

Mphasis also denied Rojas’s allegation in his duplicate website that the company had hired a private investigator to track him.

“Mphasis retained outside counsel who in turn hired private investigator Brad D. Kelly to locate me and retrieve a QBE-issued laptop. According to Brad Kelly’s sworn declaration filed in this case, his assignment included recovering the device, even though Mphasis had already issued a ‘No Due’ clearance form. This effort appears designed to shield QBE from accountability for having failed to retrieve or manage an active corporate endpoint for over five months,” reads a screengrab of Rojas’s duplicate website attached by Mphasis as part of its 15 June complaint.

“Defendant has not only disparaged Mphasis and activated the website using its name in the domain in violation of the PI, but now has disparaged Mphasis’ counsel with false accusations,” said Mphasis’ counsel. “It is clear that Defendant has no intention of following court orders, including that of May 15, 2025 wherein Defendant was ordered to bring his personal laptop to the Courthouse for a forensic examination on May 29, 2025.”

Also read | Mphasis to lose FedEx business accounting for 8% of total revenue

What’s at stake for Mphasis

Mphasis’s revenue growth of 4.43% in 2024-25 was the slowest among its peers, many of which reported growth in double digits. India’s seventh-largest information technology outsourcer was also the only company among its peers to report a decline in headcount.

The Mphasis stock is down nearly 5% this year, while the Nifty IT index has lost about 9%. On Tuesday morning, Mphasis’s shares were up by about 0.5% at ₹2,720.00 each on NSE.

Mphasis has sought at least $5,000 in damages from Rojas.

“Mphasis has suffered damage and loss by reason of, and as the proximate result of, Rojas’ conduct in violation of the Computer Fraud and Abuse Act described above, and the value of such loss to Mphasis exceeds $5,000.00 for a one-year period,” the company said in its complaint.

Rojas in his response has asked the court to dismiss Mphasis’s complaint and sought punitive and compensatory damages including his legal fees. He has also asked the court to get Mphasis to reinstate him.

“Mphasis does not comment on the specifics of ongoing litigation,” said Deepa Nagaraj, global head of communications, in a response to Mint’s email on 15 June. “At the appropriate time, or upon conclusion of the matter, details will be available through the court or via our legal counsel. We remain confident that the legal proceedings will validate our position,” said Nagaraj.

QBE did not reply to queries emailed on 11 June.

Rojas directed Mint to his court filings and reiterated his stance.