Star Health Insurance is at the center of a significant data breach, with sensitive information of over 31 million customers allegedly being sold online. A hacker, identified as “xenZen,” claims to have stolen 7.24 TB of personal and financial data, sparking major concerns over data security in India’s health insurance sector.

Key Points:

Data breach impacts over 31 million Star Health Insurance customers.

The hacker claims to be selling 7.24 TB of sensitive data for $150,000.

Data includes personal details, PAN numbers, health conditions, and more.

Star Health confirms an investigation and denies involvement in the breach.

Authorities and cybersecurity experts are actively involved in the probe.

Breach Details:

The data breach reportedly includes highly sensitive information such as names, phone numbers, PAN numbers, email addresses, health conditions, policy numbers, and even salaries of customers. The hacker, “xenZen,” is allegedly selling the entire database for $150,000, with smaller portions of 100,000 entries available for $10,000. This breach, one of the largest in India’s health insurance industry, has raised alarms about the vulnerabilities of digital systems in the financial and insurance sectors.

Hacker’s Allegations:

The hacker went so far as to claim that Star Health “sponsored” the breach by selling the data directly, an accusation the company has vehemently denied. According to the hacker’s post, the stolen data was obtained through vulnerabilities in Star Health’s systems, which allowed unauthorized access to sensitive customer information.

Star Health’s Response:

Star Health Insurance has acknowledged the attack, describing it as a “targeted malicious attack” and confirmed that a detailed forensic investigation is underway. The company is working closely with independent cybersecurity experts and relevant government bodies to trace the source of the breach. They have also filed a criminal complaint against the hacker and are pursuing legal action against Telegram, where parts of the leaked data were shared.

“We want to assure our customers that our services remain unaffected, and a comprehensive investigation is being conducted to safeguard their information. We are taking all necessary legal steps to address this issue and will work with the authorities to hold the perpetrators accountable,” said Star Health in a statement. The company further urged the public to avoid interacting with the leaked data, as doing so could have legal consequences.

Data Leak Verification:

To verify the leak, the hacker has reportedly set up two chatbots that allow potential buyers to view snippets of the stolen data. These bots, available on the dark web, are being used to demonstrate the authenticity of the information. Meanwhile, Star Health has warned the public that accessing or engaging with the leaked data is illegal and could lead to criminal penalties.

Government and Regulatory Involvement:

As the investigation unfolds, regulatory bodies, including insurance and cybersecurity authorities, are actively involved in the case. Cybersecurity experts have also been deployed to assess the breach and prevent further exploitation of customer data. The incident has highlighted the urgent need for stronger data protection measures in the financial and insurance sectors.

Conclusion:

This data breach serves as a stark reminder of the increasing cyber threats faced by organizations handling sensitive information. Star Health is working swiftly to address the situation, but the breach has undoubtedly raised questions about the security of customer data in India’s growing insurance market. With investigations underway and legal actions pending, the outcome of this case will likely have far-reaching implications for data privacy standards across the industry.