Hacker alleges top Star Health Insurance executive sold him data of over 31 million India users

A disturbing report is surfacing online, which is claiming that millions of people’s data has been leaked. Deedy Das, a VC at Menlo Ventures who previously worked with Google, has posted an alert about this breach on X with a list containing private details of Star Health Insurance customers. He mentioned that this data is for sale for $150,000 (approximately ₹1,26,00,000). In his post, Das claims that the hacker who accessed this data alleges that Star Health Insurance’s CISO, Amarjeet Khanuja, sold him this information. This data breach is being considered as one of the largest breaches in India.

Speaking of the data, 31 million rows of Star Health Insurance customer information have fallen into the wrong hands. This data includes names, dates of birth (DOB), addresses, phone numbers, and much more. Additionally, Das expresses his disappointment in the post, stating, ‘Nothing is private in India.’

What’s even more alarming is that Das posted a link to a dedicated website—https://starhealthleak.st—where this data can be purchased. The site is named Star Health Leaks. In the ‘About’ section, the hacker states, “I am leaking all Star Health India customers’ sensitive data and insurance claims. This leak is sponsored by Star Health and Allied Insurance Company, which sold this data to me directly. You can verify the authenticity of the data using the Telegram bots below and read about how it was sold in the section below.”

Furthermore, the website also reveals that there is data of 31,216,953 Star Health customers, which is 7.24TB. What can you access with this data? Well, it is pretty much everything you want to know about a person:

• Full Name
• PAN No.
• Mobile No.
• Email
• Date of Birth
• Residential Address
• Insured Date of Birth
• Insured Name
• Gender
• Pre-existing Disease
• Policy Number
• Health Card
• Nominee Name
• Nominee Age
• Nominee Claim %
• Nominee Relationship
• Insured Height
• Weight
• BMI, and more.

This data breach poses a significant threat to millions, exposing sensitive personal information. With over 31 million records leaked, including names, addresses, and financial details, the potential for identity theft and fraud is immense. The implications of such a breach are far-reaching and emphasise the need for better cybersecurity measures to protect personal information from falling into the wrong hands.