Star Health Issues An Official Statement On The Star Health Insurance Data Breach Controversy

A few days back India’s most massive hack took place when Star Health Insurance faced a data breach in which as per the threat actor data related to over 31 million customers that included customers’ names, PAN numbers, mobile numbers, email addresses, birthdates, residential addresses, policy numbers, details of pre-existing conditions, health card numbers and other confidential records was stolen and was also said to be listed for sale.

Shockingly the hacker also claimed that Star Health Chief Information Security Officer (CISO) Amarjeet Khanuja sponsored the data leak by purportedly selling the information directly. This data breach sparked significant concerns over data protection and security in the country. Star Health Insurance has finally decided to break its silence on this issue and has issued an official statement regarding this data breach.

Star Health Insurance Issues An Official Statement

As per the statement, “Star Health is carrying out an investigation with regard to unauthorized access by an unknown person or group of persons (Threat Actor or TA) to certain customer data. A thorough investigation by independent cyber security experts was immediately initiated and is underway. We have also reported the incident to all relevant regulatory agencies including the Computer Emergency Response Team (CERT-In) and the IRDAI on 14 August 2024. Separately, we have filed a Complaint before the Commissioner of Police, Chennai on 14 August 2024 based on which a First Information Report (FIR) was registered by the Tamil Nadu Police Cyber Crime Cell on 23 September 2024 reporting the incident, as well as a civil suit on 22 September 2024 before the Hon’ble Madras High Court, which in its order dated 24 September 2024 has, inter alia, directed all third parties, including persons unknown, to disable access to the relevant information. The incident involved a series of emails received by Star Health senior executives, in which the Threat Actor claimed unauthorized and illegal access to the customer confidential data and demanded a ransom amount of USD 68,000. Based on ongoing investigations, the Threat Actor appears to have used bots to purportedly share customer sensitive information through Telegram (the social media and messaging platform) and certain websites. ”

The company has also shared the list of events in chronological order about this matter as per which it took various actions against the threat actor and Telegram Bots to stop the stolen data from being leaked.

Talking about the current status of this issue, company has clarified that they have taken all measures to secure their system by exercising additional controls while they have also informed and south the assistance of the Tamil Nadu Cyber Security Authorities to help the company identify the threat actor.

Below are the strategies used by Star Health to protect the privacy and interests of Policyholders

• FIR filed with TN Cyber Police on 23 September 24 against the entities involved in carrying out this incident and investigations are underway. Attached for reference.
• The Honorable High Court of Madras has issued injunction dated 24 September 24 in a civil suit filed by Star Health against Telegram, Cloudflare, XenZen and Unknown Adversaries, inter alia, to prevent the leak, dissemination, and sale of sensitive data. Attached for reference.
• A comprehensive independent forensic investigation, led by cyber security experts, is in progress and will be concluded before the end of October.
• All identified preventive and proactive measures communicated to concerned stakeholders to contain the incident and further strengthen the information technology (IT) and digital landscape with action plan and timelines.
• Star Health is keeping the regulator IRDAI and its Board of Directors updated on all developments and seeking their guidance.
• Core Crisis Committee working closely with media and regulatory authorities to minimize the reputational impact.
• Star Health has released a media statement on 9 October 2024 providing assurance to their customers.