Star Health Insurance Data Breach

In September 2024, RansomHub claimed responsibility for breaching Star Health Insurance. The attackers exfiltrated approximately 31 million records containing policyholder names, phone numbers, email addresses, medical reports, tax IDs, and scanned identity documents. RansomHub published samples on Telegram and attempted to extort the company. The breach represented one of the largest healthcare data exposures in Indian history, drawing scrutiny from Indian regulators and CERT-In.

Star Health is India's largest standalone health insurance provider with over 31 million policyholders. The company processes vast amounts of sensitive medical and personal data, making it a high-value target for cybercriminals seeking health insurance information for fraud and identity theft.

RansomHub gained access through compromised credentials, exploiting weak multi-factor authentication. The group used living-off-the-land techniques to move laterally and exfiltrated data via encrypted channels over several days before deploying ransomware. Evidence suggested initial access may have occurred weeks before detection.

RansomHub is a ransomware-as-a-service (RaaS) group that emerged in 2024, known for targeting healthcare, finance, and critical infrastructure. They operate a typical double-extortion model: data exfiltration followed by ransomware deployment, with public leaks used as leverage.

Aliases

• RansomHouse
• RansomHub Group

Attribution sources

• Telegram posts by RansomHub
• Media reports
• Star Health regulatory filings

The breach exposed deeply personal medical data of millions, creating risks of medical identity theft, insurance fraud, and social engineering. Star Health faced reputational damage, regulatory penalties, and a class-action lawsuit. Indian insurance regulators mandated enhanced cybersecurity protocols.

Evidence of breach

RansomHub published sample datasets on Telegram including policy documents and identity cards. The leaked data was independently verified by cybersecurity researchers and journalists.

Countries affected

• India

Data types

• Policy Numbers
• Full Names
• Phone Numbers
• Email Addresses
• Medical Reports
• Lab Test Results
• Prescriptions
• Tax IDs (PAN)
• Scanned ID Cards (Aadhaar, Passport)
• Addresses

Star Health incurred regulatory fines, legal costs from class-action suits, and reputational damage affecting customer acquisition.

Public reaction

Widespread outrage among policyholders and calls for stronger data protection laws in India. Many customers reported phishing attempts following the leak.

Political impact

Prompted Indian parliamentary discussions on data protection and cybersecurity requirements for insurance companies.

Investigation by CERT-In and Indian insurance regulator IRDAI. Class-action lawsuit filed in India.

Civil lawsuits

• Class-action lawsuit on behalf of affected policyholders

Policy changes

• IRDAI mandated enhanced cybersecurity audits for all insurance companies

Regulatory changes

• Stricter data protection requirements under India's Digital Personal Data Protection Act

Security improvements

• Implementation of mandatory multi-factor authentication
• Regular security audits for insurance sector

Significance

The Star Health breach was one of the largest healthcare data exposures in Asia and demonstrated that major Indian enterprises remain vulnerable to sophisticated ransomware groups despite regulatory oversight.

Legacy

The breach accelerated India's regulatory push for mandatory data protection compliance and highlighted the vulnerability of the healthcare insurance sector to ransomware-driven data exfiltration.

Publishing organisations

• The Hindu
• Bloomberg
• TechCrunch
• BleepingComputer

Related events

• 2024-change-healthcare-attack
• 2024-medibank-breach-2022

Star Health engaged cybersecurity firms for incident response and remediation. The company notified affected customers and implemented enhanced security measures under regulatory direction.

Official documents

• Star Health regulatory filing to stock exchanges

References

1. [1]BleepingComputer
2. [2]The Hindu
3. [3]TechCrunch
4. [4]CERT-In advisory