Telegram Chatbots Used to Leak Data from India’s Leading Insurer, Star Health.
A recent data breach involving Star Health, India’s largest health insurer, has raised significant concerns about data privacy and the security of personal information. Sensitive customer data has been leaked through Telegram chatbots, just weeks after the app’s founder, Pavel Durov, was arrested in France over allegations of facilitating criminal activity on the platform.
The leaked data includes highly personal information such as names, numbers, addresses, tax details, ID card, and medical diagnoses. This sensitive information was made accessible through chatbots on Telegram. The alleged creator of these chatbots, known by the alias “xenZen,” claims to have obtained a staggering 7.24 terabytes of data related to over 31 million Star Health customers. While some of this data is available for free in small portions via the chatbot, it is also being offered for sale in bulk.
In response to this alarming breach, Star Health has reported the unauthorized data access to local authorities, including the cybercrime department of Tamil Nadu and the federal cybersecurity agency CERT-In. The company emphasized that an initial assessment indicated “no widespread compromise” and assured customers that “sensitive customer data remains secure.” However, they did acknowledge in an August 14 stock exchange filing that they were investigating a breach involving “a few claims data.”
Telegram’s platform allows users to create chatbots, a feature that has contributed to its global popularity with 900 million active monthly users. However, this same feature has made it susceptible to misuse by malicious actors. After being alerted by Reuters about the chatbots leaking Star Health data, Telegram swiftly removed them and urged users to report any similar incidents.
For many Star Health customers, the breach has been a source of distress and uncertainty. Individuals like Sandeep TS and Pankaj Subhash Malhotra discovered their personal and medical details were exposed without any prior notification from the insurer. This lack of communication has left affected customers feeling vulnerable and concerned about potential misuse of their information.
This incident underscores the challenges faced by companies in India and globally in safeguarding customer data. It also highlights concerns about Telegram’s content moderation practices and its struggle to prevent criminal misuse of its platform. The breach is part of a broader trend where hackers exploit chatbots to sell stolen data. According to a recent survey by NordVPN, India accounted for 12% of victims in such data breaches.
As technology continues to evolve, ensuring robust data protection measures becomes increasingly crucial to protect individuals’ privacy and security.
