Star Health denied a 31M-customer data leak while Telegram bots sold medical records

In September 2024 a hacker styling himself 'xenZen' published a website with sample records and set up Telegram chatbots that dished out the personal data of about 31 million Star Health policyholders: full names, phone numbers, home addresses, PAN and tax details, ID cards, medical reports and over 5.8 million insurance claims. UK researcher Jason Parker flagged the trove on September 20. xenZen claimed Star Health's own Chief Information Security Officer had sold him the data and later tried to renegotiate, and posted video of alleged email and chat exchanges with the executive.

Star Health's first response was to minimise. It said there was 'no evidence' of a customer-data breach, called the reports rumours, and sued Telegram and Cloudflare at the Madras High Court — attacking the distribution channels before it would admit the data was its customers'. Only on October 9, after weeks of chatbots serving real medical records, did the company confirm a 'malicious cyberattack'. Reuters then reported a $68,000 ransom demand and that the insurer was probing the alleged role of its own security chief, who was suspended while claiming he was being framed.

The Madras High Court granted an interim injunction and in late October Telegram agreed to take down any account Star Health flagged, while telling Justice K. Kumaresh Babu it could not 'patrol' all accounts or trace posters' IPs under the IT Act. The court noted the leak violated policyholders' right to privacy, not just the company's data. By October 28 Star Health said the hacker's sites and chatbots were down and that an internal probe had cleared its CISO of involvement.

Personal and medical data of 3.1 crore policyholders plus 5.8M claims leaked; $68,000 ransom demand; CISO suspended and probed; suits against Telegram and Cloudflare

Insider-adjacent source: the hacker's story implicated the CISO by name, making legal offence (suing platforms) more attractive than factual disclosure while the probe ran.

Deny-first reflex: early 'no evidence of customer data breach' statements bought days but were contradicted daily by chatbots serving real claims data to anyone who asked.

Access-control failure: months of bulk claims data sitting reachable enough to leak 31 million records suggests policyholder data was not ring-fenced from insiders.

Channel-first legal strategy: pursuing Telegram and Cloudflare before confirming the breach put the company in the position of suing messengers for distributing data it would not admit losing.

Deny-first crisis response turns a security incident into a trust collapse. When the leak implicates your own security chief, disclosure and an independent probe cost less than denial.

The chatbots and leak sites were taken down by late October 2024 and the internal probe absolved the CISO, but the case became a reference point for India's data-protection debate months after the DPDP Act's passage. The Madras High Court kept hearing the injunction, with Telegram obliged to block every flagged account. Star Health, which covers some 170 million lives, kept growing, but the episode — 3.1 crore policyholders' medical histories traded in the open for months while the insurer called it rumours — remains the standard example of how not to respond to a breach.