Massive Health Insurer Data Breach Exposes 31 Million Policyholders in India
In September 2024, a cyberattack on one of India’s leading health insurers resulted in the exposure of nearly 7.24 terabytes of sensitive customer data, affecting over 31 million policyholders. The leaked database reportedly included PAN details, addresses, income tax documents, medical records, laboratory reports, and diagnosis histories, leaving victims vulnerable to long-term fraud.
Impact of the Breach
Stolen health data enables medical fraud, such as fake insurance claims, unauthorized treatments, or prescription purchases under victims’ names. Financial fraud often follows, with attackers using compromised credentials to attempt account takeovers, loan applications, and SIM swaps, leading to financial losses and damaged credit scores.
Regulatory and Legal Framework
Under India’s Digital Personal Data Protection (DPDP) Act, 2023, organizations collecting personal data remain liable for breaches, even if they occur at a third-party vendor. Once fully operational by May 2027, companies must report breaches to the Data Protection Board and affected individuals without delay, followed by a detailed report within 72 hours. Violations can result in penalties of up to ₹250 crore.
India’s framework aligns with global standards like the EU’s GDPR, which mandates breach notifications within 72 hours and imposes fines of up to €20 million or 4% of global turnover Meta was fined €1.2 billion in 2023 under GDPR.
Financial Protections for Victims
Cyber insurance policies, offered by major Indian insurers, cover financial fraud, identity theft, data restoration, medical fraud, and credit monitoring. The RBI’s Zero-Liability Rule protects victims of unauthorized transactions if reported within three working days (extending to five days from January 2027). For scams involving coerced payments (e.g., phishing, fake "digital arrest" calls), victims can reclaim 85% of losses up to ₹50,000, capped at ₹25,000 once in a lifetime.
Response Measures for Affected Individuals
Victims are advised to:
- Change compromised passwords and enable two-factor authentication.
- Monitor bank and UPI transactions for at least a year.
- Check credit reports via CIBIL or Experian.
- Report suspicious activity to banks and cybercrime.gov.in or the National Cybercrime Helpline (1930).
The breach underscores the long-term risks of exposed personal data, with consequences persisting well beyond the initial incident.
Source: https://www.rediff.com/getahead/report/life-after-leak-when-your-data-gets-stolen/20260818.htm
Union Insurance cybersecurity rating report: https://www.rankiteo.com/company/union-insurance
"id": "UNI1787070340",
"linkid": "union-insurance",
"type": "Breach",
"date": "9/2024",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '31 million',
'industry': 'Insurance/Healthcare',
'location': 'India',
'type': 'Health Insurer'}],
'customer_advisories': 'Victims are advised to take protective measures such '
'as monitoring transactions, checking credit reports, '
'and reporting suspicious activity.',
'data_breach': {'number_of_records_exposed': '31 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['PAN details',
'Addresses',
'Income tax documents',
'Medical records',
'Laboratory reports',
'Diagnosis histories']},
'date_detected': '2024-09',
'description': 'In September 2024, a cyberattack on one of India’s leading '
'health insurers resulted in the exposure of nearly 7.24 '
'terabytes of sensitive customer data, affecting over 31 '
'million policyholders. The leaked database reportedly '
'included PAN details, addresses, income tax documents, '
'medical records, laboratory reports, and diagnosis histories, '
'leaving victims vulnerable to long-term fraud.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '7.24 terabytes',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential fines up to ₹250 crore under DPDP '
'Act, 2023',
'payment_information_risk': 'High'},
'lessons_learned': 'The breach underscores the long-term risks of exposed '
'personal data, with consequences persisting well beyond '
'the initial incident.',
'recommendations': ['Change compromised passwords and enable two-factor '
'authentication.',
'Monitor bank and UPI transactions for at least a year.',
'Check credit reports via CIBIL or Experian.',
'Report suspicious activity to banks and '
'cybercrime.gov.in or the National Cybercrime Helpline '
'(1930).'],
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'regulations_violated': ['Digital Personal Data '
'Protection (DPDP) Act, '
'2023'],
'regulatory_notifications': 'Required under DPDP '
'Act (once '
'operational)'},
'title': 'Massive Health Insurer Data Breach Exposes 31 Million Policyholders '
'in India',
'type': 'Data Breach'}