Last month, it was reported that sensitive customer data of Star Health Insurance is up for sale on Telegram. This is the data of 31 million customers and data includes private details such as name, address, email, date of birth, phone number, PAN Card, salary, and more. There’s also a dedicated website for anyone to buy the complete data or a part of the data.
After the news created a buzz, Star Health and Allied Insurance issued a statement and confirmed that it had reported the incident to local authorities.
The hacker alleged that the data was shared by a company insider, but experts dismissed this claim. Instead, they pointed to vulnerabilities in third-party systems as the more likely source of the leak.
Now the hacker has shared email screenshots and confirmed the name of the company insider. It has been claimed that the data was sold to the hacker by company CISO Amarjeet Khanuja. He provided illegal API access to full customer data for $43000 and then asked another $150,000 to share the amount with the senior management team.
X user @leading_nowhere also posted screenshots of emails shared between Amarjeet Khanuja and the hacker. Email screenshots confirm that Amarjeet provided API access and demanded the amount.
Along with email screenshots, we also got a video showing the conversation between the hacker and the data seller.
It is surprising to see that the official email address was used for the communication. How can someone be so dumb to use the official email address for this? Now there could be the possibility of email spoofing to put blame on Amarjeet. But it should be investigated to find out the real culprit.
I cannot confirm the authenticity of the email screenshots or video. But the claim is huge and raises several questions. We trust companies about our personal data, but should we trust them? Star Health should now come forward and provide more details.
The Insurance Regulatory and Development Authority of India (IRDAI) must take immediate action and launch a thorough investigation into Star Health to uncover the exact cause of the incident. Regardless of whether this was an insider’s job or not, Star Health must be held accountable for this data leak.
The leaked data can be used to harm customers in many ways including Identity theft, Financial fraud, Targeted scams, Hacking other accounts, Phishing attempts, Account takeovers, and Extortion. If you are an existing Start Health customer, you need to take extra care while handling emails, calls, and messages related to Star Health in the coming months.
