A few days back India’s most massive hack took place when Star Health Insurance faced a data breach in which as per the threat actor data related to over 31 million customers that included customers’ names, PAN numbers, mobile numbers, email addresses, birthdates, residential addresses, policy numbers, details of pre-existing conditions, health card numbers and other confidential records was stolen and was also said to be listed for sale.

Shockingly the hacker also claimed that Star Health Chief Information Security Officer (CISO) Amarjeet Khanuja sponsored the data leak by purportedly selling the information directly. This data breach sparked significant concerns over data protection and security in the country. Star Health Insurance has finally decided to break its silence on this issue and has issued an official statement regarding this data breach.

Star Health Insurance Issues An Official Statement

As per the statement, “Star Health is carrying out an investigation with regard to unauthorized access by an unknown person or group of persons (Threat Actor or TA) to certain customer data. A thorough investigation by independent cyber security experts was immediately initiated and is underway. We have also reported the incident to all relevant regulatory agencies including the Computer Emergency Response Team (CERT-In) and the IRDAI on 14 August 2024. Separately, we have filed a Complaint before the Commissioner of Police, Chennai on 14 August 2024 based on which a First Information Report (FIR) was registered by the Tamil Nadu Police Cyber Crime Cell on 23 September 2024 reporting the incident, as well as a civil suit on 22 September 2024 before the Hon’ble Madras High Court, which in its order dated 24 September 2024 has, inter alia, directed all third parties, including persons unknown, to disable access to the relevant information. The incident involved a series of emails received by Star Health senior executives, in which the Threat Actor claimed unauthorized and illegal access to the customer confidential data and demanded a ransom amount of USD 68,000. Based on ongoing investigations, the Threat Actor appears to have used bots to purportedly share customer sensitive information through Telegram (the social media and messaging platform) and certain websites. ”

The company has also shared the list of events in chronological order about this matter as per which it took various actions against the threat actor and Telegram Bots to stop the stolen data from being leaked.

Talking about the current status of this issue, company has clarified that they have taken all measures to secure their system by exercising additional controls while they have also informed and south the assistance of the Tamil Nadu Cyber Security Authorities to help the company identify the threat actor.

Below are the strategies used by Star Health to protect the privacy and interests of Policyholders

• FIR filed with TN Cyber Police on 23 September 24 against the entities involved in carrying out this incident and investigations are underway. Attached for reference.
• The Honorable High Court of Madras has issued injunction dated 24 September 24 in a civil suit filed by Star Health against Telegram, Cloudflare, XenZen and Unknown Adversaries, inter alia, to prevent the leak, dissemination, and sale of sensitive data. Attached for reference.
• A comprehensive independent forensic investigation, led by cyber security experts, is in progress and will be concluded before the end of October.
• All identified preventive and proactive measures communicated to concerned stakeholders to contain the incident and further strengthen the information technology (IT) and digital landscape with action plan and timelines.
• Star Health is keeping the regulator IRDAI and its Board of Directors updated on all developments and seeking their guidance.
• Core Crisis Committee working closely with media and regulatory authorities to minimize the reputational impact.
• Star Health has released a media statement on 9 October 2024 providing assurance to their customers.

The post Star Health Issues An Official Statement On The Star Health Insurance Data Breach Controversy appeared first on The Tech Outlook.

Following the lawsuit that Star Health had filed against Telegram and an unknown hacker two weeks ago and amidst the arrest of Telegram Founder and CEO Pavel Durov, a massive data breach has taken place in the country. The name of Star Health and Allied Insurance Co. Ltd. has again made the news and this time, the hacker who is responsible claims that the data was allegedly sold by a senior executive of the company.

Read more about the news below.

Star Health Data Breach – One of India’s Massive Data Breaches

While it is still unclear whether the hacker responsible for this current data breach is the same hacker that Star Health sued two weeks back or not, via the website that has been created now, over 31 million personal data of Star Health customers is at risk. The hacker who has been identified as ‘xenZen’ has listed the entire data set on the website for $150,000 and as smaller batches of 100,000 entries for $10,000 each. 500 data samples have also been provided on the website.

Identity thefts, phishing attempts, targeted scams, financial fraud, account takeover, extortion, and hacking of other related accounts are all some serious consequences that can happen due to such a data leak.

What is more shocking is that, this time, the name of a Senior Star Health Executive has also been linked to the data breach as the hacker claims that the data was sold to him by this person. The hacker also adds that more money was later demanded for backdoor access to information.

An ongoing investigation is currently taking place and the company acknowledged that it was the victim of this cyber attack. The investigation being led by independent cyber security experts, closely working with government and regulatory authority, is duly being reported to the insurance and cyber security regulatory authorities of the country. The company has also approached the Madras High Court regarding the matter as well.

Star Health also adds that Amarjeet Khanuja, the Senior Vice President and Chief Information Security Officer of Star Health, and the accused senior executive, has been cooperating well with the investigation and so far nothing has been found to prove his involvement in the matter. It should also be noted that the operations of the company will not be affected and all services will be provided to customers without any disruptions.

The post Star Health Massive Data Breach Shocks the Country: Over 31 Million Customer Data Leaked appeared first on The Tech Outlook.