By 
Star Health and Allied Insurance confirmed that it was hit by a malicious cyber attack which resulted in unauthorized and illegal access to certain data.
The Indian health insurance provider assured that its operations remained unaffected. A thorough and rigorous forensic investigation, led by independent cybersecurity experts, is underway, and the insurance provider is working closely with government and regulatory authorities at every stage of this investigation.
Star Health which is headquartered in Chennai offers health insurance to over 17 crore Indians through a vast network of around 14,000 hospitals and 850 offices in the country. It also provides personal accident as well as overseas and travel insurance.
However it is uncertain if the breach involved customers’ data and how hackers were able to access the sensitive information.
According to a report by Reuters, the personal data belonging to over 31 million Star Health policyholders as well as information pertaining to over 5.8 million claims were made publicly accessible last month via Telegram chatbots.
Hackers reportedly used Telegram chatbots to share samples of the personal data with potential buyers. The personal health data on sale included phone numbers, addresses, tax details, copies of ID cards, test results, and medical diagnoses reports of victims.
A day later, Telegram reportedly took down the chatbots after initially marking them as ‘Scam’ with a label warning that users had reported the bots as suspicious.
Weeks after the Telegram bots were taken down, the hackers reportedly built a website that listed the Star Health dataset for sale at $150,000 (Rs 1.25 crore approx.)
“I am leaking all Star Health India customers and insurance claims sensitive data. This leak is sponsored by Star Health and Allied Insurance Company, which sold this data to me directly. You can check the authenticity of the data in the Telegram bots below and read about how they sold it in the section below,” the hackers’ website read.
They also alleged that Star Health’s chief information security officer sold them the data.
Star Health has moved the Madras High Court against Telegram for hosting the chatbots that were used to sell the stolen data.
Star Health also stated that their CISO has been duly co-operating in the investigation, and they have not arrived at any finding of wrongdoing by him till date.
