Star Health clarifies services are secure amid $68,000 ransom demand, customer data breach
The company, in a statement, said that it adheres to the 2023 Insurance Regulatory and Development Authority of India (IRDAI) guidelines on cyber security and is certified under ISO/IEC 27001 for information security.
It added that a Risk Management Committee, established by Star Health’s board, actively manages the company’s cyber security measures.
The breach, first reported in September, involved the leak of sensitive customer data, including tax information and medical records. The hacker, known as xenZen, allegedly used Telegram chatbots and a website to expose these details.
On August 2023, Star Health received a ransom demand of $68,000 via email, which was directed to the company’s managing director and CEO. The company stated it is a “victim of a targeted malicious cyberattack,” and investigations into the breach are ongoing.
Star Health has launched internal probes and taken legal action against both the hacker and Telegram, the platform used to disseminate the stolen data.
Although Telegram has removed some of the chatbots linked to the leak after being alerted by media reports, the messaging platform has refused to provide further details about the hacker or permanently ban the involved accounts, despite multiple notices from Star Health.
The company is also under scrutiny following reports suggesting its Chief Security Officer, Amarjeet Khanuja, may have been involved in the breach.
However, Star Health reiterated that no evidence has been found implicating Khanuja in the data leak. The investigation into the matter is still ongoing.
To identify the hacker, Star Health has sought assistance from Indian cyber security authorities. Meanwhile, the data breach has negatively impacted the company’s market performance, with its share value dropping by 11%.
