SUMMARY
- Star Health Insurance has recently faced a significant data breach.
- Claims have been made that a senior executive sold the personal information of over 31 million customers to hackers.
- The hacker is now offering to sell the entire dataset for $150,000.
Star Health Insurance has recently faced a significant data breach following allegations that a senior executive allegedly sold the personal information of more than 31 million customers to hackers, as claimed on a hacker website.
The website, operated by a hacker known as xenZen, alleges that Amarjeet Khanuja, the chief information security officer at Star Health Insurance, not only sold the data but also attempted to renegotiate the deal, seeking additional compensation for access to the company’s systems for senior management.
“Star Health management CISO (Chief information security officer) Amarjeet (as mc6) sold all this data to me and then attempted to change deal terms saying senior management of company needs more money for backdoor access,” the website stated.
The hacker is now offering to sell the entire dataset for $150,000 or in smaller portions of 100,000 entries each for $10,000.
Star Health responded, “We acknowledge that we were the victim of a targeted malicious cyberattack, resulting in unauthorised and illegal access to certain data. We make it absolutely clear that our operations remain unaffected, and all services continue without disruption.”
“We also want to categorically mention that our CISO has been duly co-operating in the investigation and we have not arrived at any finding of wrongdoing by him till date. We request that his privacy be respected as we know that the threat actor is trying to create panic. We also want to emphasise that any unauthorised acquisition, possession, or dissemination of customer data is illegal,” they added.
“A thorough and rigorous forensic investigation, led by independent cybersecurity experts, is underway, and we are working closely with government and regulatory authorities at every stage of this investigation,” they added further.
Last month, Star Health Insurance filed lawsuit against Telegram and a hacker claiming to be self-proclaimed, following reports from Reuters that the hacker was utilizing chatbots on the messaging app to leak personal data and medical records of policyholders.
This breach exposed over 7.24 terabytes of sensitive customer information through Telegram bots. The website was able to access the private data of numerous individuals, which included full names, phone numbers, email addresses, birth dates, addresses, existing medical conditions, policy numbers, details of nominees, and even the height and weight of insured individuals.
The data on over five million insurance claims, including Aadhaar card and PAN card photos, detailed medical reports, and information on insurance claims, is now available on the Telegram app to the general public.
This sensitive information could be exploited for identity theft, financial fraud, targeted scams, hacking other accounts, phishing attempts, account takeovers, and extortion.
This incident comes at a time when Telegram is facing increasing global scrutiny, following the arrest of its founder Pavel Durov in France last month, raising concerns about the app’s features being misused for illegal activities.
In July, one of WazirX’s multisig wallets was targeted, resulting in the loss of digital assets valued at over $230 million.
Similarly, in the same month, cybercriminals succeeded in transferring Rs 40 crore from customers of IndusInd Bank into various mule accounts, but Maharashtra cyber cell officials managed to recover Rs 33 crore.
Meanwhile, to address the growing number of cyberattacks, the Indian government has established a central registry of suspects. Additionally, the Centre has launched a Cyber Fraud Mitigation Centre (CFMC) and the Samanvay platform to combat cyber crimes.
