A significant data breach has exposed sensitive customer information from Star Health, India’s largest health insurer, through chatbots on Telegram. The breach, discovered by a UK-based security researcher and reported by Reuters, involves stolen data, including medical reports, ID cards, and contact details, accessible via Telegram chatbots operated by a user under the alias “xenZen.”
The breach came to light when xenZen claimed on an online hacker forum to possess 7.24 terabytes of data linked to over 31 million Star Health customers, which they were offering for sale. They provided samples through chatbots, which could be accessed by anyone requesting random data. Reuters verified the existence of these chatbots and downloaded over 1,500 files containing sensitive information.
Read More: Telegram to allow users to report illegal content in private chats
Star Health responded by reporting the unauthorized data access to local authorities and conducting an internal assessment, concluding that there was no widespread compromise of sensitive customer data. However, despite their assurances, personal information continued to be leaked and accessed through new chatbots, even after some were shut down by Telegram.
Telegram has faced increased scrutiny, especially after the arrest of its founder, Pavel Durov, for alleged criminal facilitation through the platform. Although Telegram denied wrongdoing, the ease with which criminals use chatbots to disseminate stolen data raises concerns about the app’s moderation policies.
The incident highlights significant challenges in data security for Indian companies and emphasizes the growing trend of using platforms like Telegram to sell stolen data. Star Health continues to cooperate with authorities to address the breach and assure customers that their privacy is a top priority, but the impact on affected individuals and the effectiveness of remedial actions remain to be seen.
