Stolen customer data including medical reports from India's biggest standalone health insurer, Star Health and Allied Insurance, is publicly accessible via chatbots on Telegram, reported Reuters.
The purported creator of the chatbots told a security researcher, who alerted Reuters to the issue, that private details of millions of people were for sale and that samples could be viewed by asking the chatbots to divulge.
Using the chatbots, Reuters was able to download policy and claims documents featuring names, phone numbers, addresses, tax details, copies of ID cards, test results, and medical diagnoses.
The Star Health chatbots feature a welcome message stating they are "by xenZen" and have been operational since at least 6 August, said UK-based security researcher Jason Parker. He said he posed as a potential buyer on an online hacker forum where a user under the alias xenZen said they made the chatbots and possessed 7.24 terabytes of data related to over 31m Star Health customers.
Star Health said in a statement to Reuters that it has reported alleged unauthorised data access to local authorities. The insurer reported the matter to the cybercrime department of its home state of Tamil Nadu and the federal cyber security agency CERT-In.
The insurer also said an initial assessment showed "no widespread compromise" and that "sensitive customer data remain secure".
To read the full article, please click here.