Star Health sues Telegram, hacker, and Cloudflare over data leak

Star Health, one of India’s largest insurance providers, has taken legal action against the messaging platform Telegram and a self-proclaimed hacker after a Reuters investigation revealed that personal data and medical reports of its policyholders were being leaked via chatbots on the platform. The lawsuit also includes U.S.-based software firm Cloudflare Inc., which Star claims was used to host websites distributing the stolen data.

A court in Tamil Nadu, Star’s home state, has issued a temporary injunction, ordering Telegram and the hacker to block access to any chatbots or websites sharing the leaked information. The Madras High Court’s September 24 ruling also restricts Telegram and Cloudflare from using the insurer’s trade name, “Star Health,” and from making any of its data accessible online. The court will next hear the case on October 25.

The legal action stems from a report by Reuters, which revealed that a hacker, using the pseudonym “xenZen,” had made stolen data from Star Health customers available on Telegram chatbots. The leaked data reportedly includes sensitive information such as medical reports, policy documents, names, phone numbers, addresses, and tax details. Some of these documents were dated as recently as July 2024.

In response to the findings, Star Health initially stated that its internal investigation had found “no widespread compromise” and assured customers that “sensitive customer data remains secure.” However, the leak’s extent was further confirmed when Reuters successfully downloaded more than 1,500 files containing personal information. After Reuters alerted Telegram about the chatbots, the platform removed them within 24 hours, but new chatbots soon emerged.

Star Health seeks an injunction to prevent Telegram, Cloudflare, and the hacker from further distributing customer data. The company made the lawsuit public through a newspaper advertisement in The Hindu, detailing its request for the court to stop the unauthorized use of its name and data. The hacker “xenZen” responded to Reuters, stating their willingness to join the court hearings online if permitted. Neither Telegram, Cloudflare, nor Star Health responded to requests for comment from Reuters.

This case follows growing concerns over Telegram’s role in facilitating the dissemination of illegal content, with its founder recently accused of allowing the platform to be used for criminal activities.