Get All Access for $5/mo

Insider Cyberattack? Star Health Insurance CISO Allegedly Sells Sensitive Data to Chinese Hacker Personal data of 31 million Indians allegedly sold for USD 150,000

By Entrepreneur Staff

You're reading Entrepreneur India, an international franchise of Entrepreneur Media.

Freepik

Global malicious groups are constantly targeting Indian institutions. In a disturbing development, Star Health Insurance has suffered a massive data breach after the firm's Chief Information Security Officer (CISO) allegedly sold sensitive credentials of 31 million Indians including PAN/Aadhaar numbers, phone numbers, emails, and home addresses. The CISO reportedly sold this data for USD 150,000 (approximately INR 1,26,00,000) to a Chinese hacker identified as "xenZen."

This incident sparked a debate on X (formerly Twitter) when Deedy Das, a venture capitalist at Menlo Ventures and a former Google employee, posted about the data leak. Das shared details of the breach, including the name of the security officer allegedly involved. In his post, a conversation between the officer and the hacker is shown, where the officer demands more money for backdoor access on behalf of senior management.

"Star Health management's CISO, Amarjeet (known as 'mc6'), sold all this data to me and then attempted to change the deal terms, stating that senior management of the company needed more money for backdoor access," Hacker said on his website.

The malicious actor is now selling the entire dataset for USD 150,000 or in smaller batches of 100,000 entries for USD 10,000 each.

Following the incident, Star Health Insurance said in the media, "We acknowledge that we were the victim of a targeted malicious cyberattack, resulting in unauthorized and illegal access to certain data. We want to make it absolutely clear that our operations remain unaffected, and all services continue without disruption."

The company further stated that the officer has not been found guilty of any wrongdoing to date. "We want to categorically state that our CISO has been fully cooperating with the investigation, and there has been no finding of wrongdoing by him to date. We request that his privacy be respected, as the threat actor appears to be attempting to create panic. We also want to emphasize that any unauthorized acquisition, possession, or dissemination of customer data is illegal."

In a different incident last month, Star Health Insurance filed a lawsuit against Telegram and a self-proclaimed hacker after a Reuters report revealed that the hacker was using chatbots on the messaging app to leak personal credentials and medical reports of policyholders. This breach exposed over 7.24 terabytes of sensitive information via Telegram bots.

These bots have made sensitive data of multiple individuals publicly accessible, including names, PAN numbers, mobile numbers, email addresses, dates of birth, residential addresses, pre-existing medical conditions, policy numbers, and nominee details. Additionally, personal information such as the height and weight of insured individuals, over five million insurance claims, Aadhaar card and PAN card photos, detailed medical reports, and insurance claim information are now circulating on Telegram and accessible to the public.

Regarding the recent data leak, Das explained that this data in the public domain poses a significant threat, as hackers could use it for financial fraud, identity theft, targeted scams, account hacking, phishing attempts, account takeovers, and extortion in the future.

Following a forensic investigation into the matter, Star Health Insurance's shares dropped by 2.5 per cent.

Entrepreneur Staff

Entrepreneur Staff

Editor

For more than 30 years, Entrepreneur has set the course for success for millions of entrepreneurs and small business owners. We'll teach you the secrets of the winners and give you exactly what you need to lay the groundwork for success.
Business News

'Jaw-Dropping Performance in 2024,' Says a Senior Analyst as Nvidia Reports Earnings

Nvidia reported its highly-anticipated third-quarter earnings on Wednesday.

Business News

'Do You Sell Cars?': Tesla CEO Elon Musk Trolls Jaguar Rebrand on X

The team running Jaguar's X account was working hard on social media this week.

Starting a Business

He Started a Business That Surpassed $100 Million in Under 3 Years: 'Consistent Revenue Right Out of the Gate'

Ryan Close, founder and CEO of Bartesian, had run a few small businesses on the side — but none of them excited him as much as the idea for a home cocktail machine.

Employee Experience & Recruiting

Avoid Costly Hiring Mistakes by Spotting These Employee Warning Signs

Hiring is an art, not a science — especially today, with computer-generated résumés, an extremely diverse candidate pool, and decreasing employee loyalty. Here are some tips for how to zero in on the right applicants, with equal parts caution and consideration.

Money & Finance

5 Links You Need to Be Successful As a Day Trader

Mastering drive, computer skills, emotional regulation, situational awareness and discipline are essential for day trading success.

Business News

'Unexpected Funding': Paychex's Founder Donates $85 Million to 41 Nonprofits. Here's Where the Money Is Going.

Paychex founder Tom Golisano has given half a billion dollars to philanthropic causes this year alone.