Plea In Madras High Court Seeks Probe Into Data Breach At Star Health Insurance

A plea has been filed in the Madras High Court raising concerns about the security breach of Star Health Insurance Limited. An interim injunction petition has also been filed to suspend the online operation of Star Health Insurance.

When the matter was taken up by Justice Dhandapani on Monday, the judge said that he would hear the case on Thursday (17th October) and pass orders on whether the Central Government had authority to take action against the insurance company.

The petitioner, Himanshu Pathak, founder of cyber security firm CyberX9, had approached the court to direct the Ministry of Home Affairs to take action based on the representation sent by him regarding security breach by Star Health Insurance. Pathak had alleged that there were critical vulnerabilities in the cyber security of Star Health.

On October 9 this year, the Insurance Company had admitted that it was a victim of malicious cyber attack which resulted in unauthorised and illegal access to data.

Senior Advocate Srinath Sridevan appearing for Pathak, on Monday submitted that officials from the insurance company had sold the data to a Chinese hacker including medical details, PAN details and other sensitive data.

The counsel for Star Health informed the court that the company had also filed a civil suit and an injunction had also been granted in its favour. The central government informed the court that an inquiry into the data breach could be conducted only by the Insurance Regulatory and Development Authority of India and not by the central government.

To this, the judge said that he would decide on the issue on Thursday and adjourned the case.

Case Title: Himanshu Pathak v. Ministry of Electronics and Information and others

Case No: WMP/31369/2024 and WP 12049/2023