Table of Contents
The insurance company, Star Health and Allied Insurance, recently suffered a major data breach, as more than 31 million customers’ data are at risk in India, leading to growing questions related to the sector’s security. This was later found to have been unauthorized and illegal access to specific information; this was confirmed on October 9. A Chennai-based health insurer has said it is still in the process of calculating the extent of the damage after the data breach incident that involved independent cybersecurity firms and government regulators.
What happened?
As claimed, hackers managed to obtain a substantial amount of customers’ personal information, such as details of their health, phone numbers, addresses, copies of their identity cards, taxation information, and even medical diagnosis. As it has also emerged, about 5.8 million insurance claims were also leaked in the same scandals. The stolen data was then disseminated through Telegram chatbots—a common mode of disseminating data successfully realized in other cyberattacks recently. Here the hackers opted to use these chatbots to input sample data where the personal information is available for sale.
According to sources, the stolen data was put up for sale at $150,000 (approximately 1.25 crore) at a site established by the hackers after Telegram shut down the bots. The site affirmed leaking all the customer data and insurance claim details of any people who had subscribed to Star Health India, a move he believed the company directly sells the data. The hackers also accused Star Health’s Chief Information Security Officer (CISO), Amarjeet Khanuja, of having a hand in the breach. But the company has refuted such revelations so far.
Key Data Compromised
The leaked data includes:
- Personal Health Information: This includes diagnoses and tests that could be devastating to people’s privacy and can have individuals robbed of their identity.
- Contact Details: Names and addresses of the policyholders, and call numbers exposing the consumers to phishing and other undesirable calls.
- Identification Documents: Documents such as ID cards and other important documents that may be needed for fraudulent activities.
- Tax Information: Financial information that if breached and exposed can cause significant risk or damage to a business.
Company response
Star Health has strongly reacted by sending legal notices to both Telegram and Cloud flare (the latter that hosts the hacker’s website) and filing a suit in the Madras High Court. Still, Cloud flare said it was not hosting the particular domain in question. This insurance company is ready to ensure that the incident will be investigated, and the company has already provided criminal complaints to different agencies, such as cybersecurity and insurance regulation authorities.
Effect of specific customers and stock volatility
While Star Health insists that the company’s operations are unbothered, the breach has caused a variety of concerns among the vast customer base. Any individual’s health-related record is at risk, and medical information can be significant to hackers as it often contains private and important information. This breach also brings focus onto the trend of using Telegram chatbots for sales of stolen data observed in other leaks, such as the CoWIN data leak.
The effects of the breach have also affected the market positions of Star Health. The firm’s share price declined by 2.5% on Thursday morning as a result of the breach and was at ₹566 per share. Although the financial and reputational costs in the long run have not been clearly estimated, the case stresses the importance of enhancing cybersecurity in expanding India’s digital economy.
What should customers do?
Star Health customers should tread carefully after data breaches. While the full scope of compromised data is still under investigation, affected individuals may want to take steps to protect themselves:
- By log monitoring of its financial accounts, one needs to look out for any fraudulent activities, particularly those touching on health insurance claims or medical records.
- Some of the detailed safety measures include the change of passwords on important aspects of the internet, such as insurance services accounts.
- Beware of phishing, because computer criminals can gather personal data to develop fake but realistic tricks.
- Contact Star Health customer support service to know additional information on the breach and protective measures provided by the company.
It is still very much open, and as the investigation goes on, it makes all of us remember the fact that no company, regardless of its size, its longevity, or the fact that it is part of an industry that prides itself on being highly secure, is immune to cybercriminals.