Star Health and Allied Insurance, India’s largest health insurer, has fallen victim to a significant cyber attack, resulting in customer data, including sensitive medical records, becoming publicly accessible through chatbots on Telegram, according to a Reuters report.
The creator of the Telegram chatbots, known under the alias “xenZen,” has revealed to Jason Parker, a security researcher, that private details of millions of Star Health customers were available for sale, with samples accessible through the chatbots. These samples included names, phone numbers, medical reports, and more.
Star Health, in a statement, acknowledged the alleged unauthorized data access but claimed its initial investigation showed no large-scale compromise. The company assured that sensitive customer data remains secure. Star Health has reported the breach to local authorities and is working with law enforcement to address the situation. Some customers said Star Health has not yet informed them about the cyber security attack and data leak.
Despite these efforts, the chatbots, which have been active since at least August 6, 2024, allowed users to access a variety of documents, including policy information and medical diagnoses. UK-based security researcher Jason Parker, who tested the bots, found that one could request up to 20 samples from a dataset of 31.2 million records.
The incident marks a growing trend in hackers using Telegram chatbots to sell stolen data. India accounted for 12 percent of the victims of such attacks in 2022, according to a NordVPN survey.
Telegram responded swiftly to reports, with spokesperson Remi Vaughn stating that the chatbots were removed within 24 hours of being flagged. However, new chatbots continue to emerge offering the same data.
