Star Health confirms data breach, clears CISO of wrongdoing amid claims

Star Health Insurance released a statement acknowledging the cyberattack. The company confirmed that it was a victim of a targeted malicious cyberattack, which led to unauthorised access to certain data.

In Short

• Star Health Insurance confirms data breach affecting millions
• Hacker claims to have accessed data of 31 million customers
• Company initiates forensic investigation and files criminal complaint

Star Health Insurance has confirmed that it has suffered a data breach. This incident has raised serious concerns about data security and privacy for millions of its customers. Reports suggested that sensitive personal and insurance details have been compromised, with the stolen data reportedly being offered for sale online.

The cyberattack, allegedly carried out by a hacker known as xenZen, has been described as severe. The hacker claims to have accessed 7.24TB of data concerning over 31 million customers. The data is being sold for $150,000, with smaller sets of 100,000 customer records available for $10,000 each.

The stolen information reportedly includes highly sensitive data such as customers' names, PAN numbers, mobile numbers, email addresses, birthdates, residential addresses, policy numbers, details of pre-existing health conditions, health card numbers, and other confidential medical records. This breach poses a significant risk to customer privacy and security.

Allegations against the CISO

The hacker claimed that Star Health’s Chief Information Security Officer (CISO), Amarjeet Khanuja, played a role in the data leak. The hacker alleged that Khanuja "sponsored" the data breach by selling sensitive information directly to them for $43,000. The claim included allegations of selling data related to 31 million Indian customers, including salary and PAN card details.

Company Statement

In response to these events, Star Health Insurance released a statement acknowledging the cyberattack. The company confirmed that it was a victim of a targeted malicious cyberattack, which led to unauthorised access to certain data. However, they assured customers that their operations were not disrupted and that all services continued as normal.

The company said, “A thorough and rigorous forensic investigation, led by independent cybersecurity experts, is underway. We are working closely with government and regulatory authorities at every stage of this investigation, including reporting the incident to insurance and cybersecurity regulatory bodies. We have also filed a criminal complaint."

Star Health also mentioned that they had approached the Madras High Court regarding the situation, which directed all relevant parties to disable access to the stolen information. The company is committed to implementing this order diligently.

Star Health Insurance made it clear that their CISO is cooperating with the investigation. The company also mentioned that there has been no finding of wrongdoing against him so far. The insurance firm said that the hacker appeared to be trying to create panic among customers.

The company added, “Any unauthorised acquisition, possession, or dissemination of customer data is illegal. We urge all platforms, hosting companies, social media channels, and users to take swift action to halt such activities and comply with the orders of the High Court.”

Star Health reassured customers and partners that their privacy and data security are a top priority. They said, “We have robust security measures in place, and we are unwavering in our commitment to ensure the continued trust and confidence of our customers.”