In one of India's largest cybersecurity incidents, personal data from Star Health Insurance – one of the country’s top health insurers – has been exposed, impacting over 31 million customers. The stolen information includes names, addresses, phone numbers, tax details, and even medical records. The breach reportedly involved a hacker, who claimed that Star Health’s Chief Information Security Officer (CISO) Amarjeet Khanuja sold the data for $150,000. A viral social media post from Deedy Das, a venture capitalist at Menlo Ventures, added to the controversy by sharing an alleged email exchange between Khanuja and the hacker.
Data Breach and Allegations
The hacker behind the breach allegedly sold sensitive data through Telegram chatbots, allowing users to access policy details, claims information, and even medical diagnoses. According to Das' post on X (formerly Twitter), the hacker accused Khanuja of attempting to profit from the data sale. Screenshots of the email exchange shared by X user @leading_nowhere claim that Star Health employee even offered illegal API access to customer medical records, which were originally priced at $43,000, before senior management raised the demand to $150,000.
Star Health Insurance had earlier filed lawsuits against both the messaging platform Telegram and the US-based software firm Cloudflare, accusing them of facilitating the data leak. The Madras High Court recently issued a temporary injunction, ordering Telegram to block any chatbots distributing the leaked information. The court is set to hold a follow-up hearing on October 25, while Star Health continues to work with law enforcement to address the situation.
What Was Leaked?
The stolen data included personal details like names, phone numbers, and addresses, along with more sensitive information such as tax details, ID card copies, test results, and medical diagnoses. Star Health acknowledged the breach but downplayed its severity, claiming there was “no widespread compromise” and assuring customers that their data remains secure.
As this breach raises significant concerns over customer privacy, Star Health continues to face mounting scrutiny over its data protection practices.