Star Health insurance hack led to personal data of 31 million customers being compromised: Story in 5 points

India's popular health insurers, Star Health insurance, faced a massive data leak this week, which may have led to the data of 31 million customers being compromised. Here is everything that has happened in the case so far.

In Short

• Star Health Insurance suffers massive data breach
• 31 million customers' data reportedly compromised
• Allegations against CISO for facilitating breach

This week, one of India’s most popular health insurers, Star Health insurance, faced a massive data breach. The company acknowledged the hack, and they said they were investigating the matter. According to reports, the alleged data leak could have led to the personal data of 31 million customers being compromised. The hacked data is apparently also listed online for sale. As if that wasn’t bad enough itself, the case complicates further. There are claims that the chief information security officer (CISO) of the company may have had a role in the data breach. The company completely denies these claims. Here is everything that is happening in this case, in a quick 5 point breakdown of the story:

5 key points in the Star Health Insurance data breach

–Massive data breach hits Star Health Insurance

Star Health Insurance, one of India's largest health insurers, allegedly suffered a significant data breach, compromising sensitive personal and insurance details of over 31 million customers. The hacker, reportedly named xenZen, claims to have accessed 7.24TB of data, offering it for sale online for $150,000. Smaller batches of 100,000 records are reportedly listed at $10,000 each.

–Sensitive customer information stolen

The compromised data reportedly includes confidential information such as customer names, PAN numbers, mobile numbers, email addresses, policy details, birthdates, and confidential medical records. This breach has raised major concerns about the safety of personal data and the vulnerability of health information in India.

–Allegations against Star Health's CISO

In a bold accusation, the hacker claimed Star Health’s CISO, Amarjeet Khanuja, facilitated the breach by allegedly selling the data directly for $43,000. According to whistleblower Deedy Das, Khanuja first contacted xenZen via an encrypted app, Tox, and provided API details and login credentials in exchange for cryptocurrency. The two reportedly conducted multiple transactions before their relationship soured.

–Star Health denies allegations

Star Health Insurance has refuted all allegations of internal involvement, calling the data breach a "targeted malicious attack." In their official statement, they assured customers that their services remain operational and that an in-depth investigation is underway. The insurer is working with cybersecurity experts and regulatory bodies to protect customer data.

–Legal action and forensic investigation launched

Star Health has initiated a forensic investigation into the breach and filed a criminal complaint, including legal action against the hacker and Telegram, where parts of the stolen data were allegedly shared. The company is also collaborating with government and regulatory agencies to mitigate the damage and prevent further data exploitation.