Star Health policyholders’ data up for sale on dark net

Hyderabad:Personal details of more than 3.1 crore Star Health Insurance policyholders have reportedly been leaked, and are up for sale on the dark web. The leaked data, which includes sensitive information like mobile numbers, PAN card details, full residential addresses and annual income, has raised major privacy and security concerns for policyholders across India, including those in Telangana and Andhra Pradesh.

The breach came to light in late September, when a hacker claimed to have gained access to the personal health information of over 3.1 crore customers of Star Health Insurance. This data was being sold on dark web platforms, and according to the hacker, the data had been obtained from the Chief Information Security Officer (CISO).

This assertion prompted Star Health to initiate an internal investigation to determine any potential link between the hacker and their CISO. Through internal investigations, the company stated that although they "were a victim of targeted malicious cyberattack", they concluded that there was no connection between the CISO and the hacker.

At present, a sample of the stolen data remains accessible online, with information of around 80 individuals displayed. This sample includes names, contact details, email addresses, complete residential addresses, PAN numbers, policy numbers, and financial details, such as annual income. The sample data consists of information from people from all across the country, including Telangana and Andhra Pradesh.

The hacker is not selling the entire data, but instead is willing to sell in parts. The hacker offered 5,00,000 customers data for $10,000, 1,00,000 customers data for $5,000 and 10,000 customers data for $1,500. Furthermore, the hacker wrote that buyers can request data from any particular city or random datasets.

An official from Star Health Insurance, who requested anonymity, said “The hacker has alleged that they got access to the information through our company’s CISO. But we and other cybersecurity experts conducted thorough investigations into the situation. There was no connection between the CISO and the hacker, proving the hacker’s claim false.”

The official also said that the hacker has made multiple accounts and posted the same sample data across multiple hacker forums, Telegram groups and websites.

The official stated that the company has filed a complaint with the government of India about the data breach. The official said that an investigation is underway to trace and apprehend the hacker.