India's Star Health sues Telegram after hacker uses app's chatbots to leak data (updated)

Star Health and Allied Insurance

26/09/2024 09:28

(Adds details from the court order, background on the data leak
paragraph 3-7, 10-12)
    By Munsif Vengattil and Aditya Kalra
       BENGALURU, Sept 26 (Reuters) - Top Indian insurer Star
Health  STAU.NS  has sued Telegram and a self-styled hacker
after Reuters reported that the hacker was using chatbots on the
messaging app to leak personal data and medical reports of
policy holders.
    Star has received a temporary injunction from a court in its
home state of Tamil Nadu ordering Telegram and the hacker to
block any chatbots or websites in India that make available the
data online, according to a copy of the order.
    Star has also sued U.S.-listed software firm Cloudflare Inc
 NET.N  in the lawsuit, saying the leaked data on websites were
hosted using its services.
    "Confidential and personal data of ... customers and of the
plaintiff's business activities in general has been hacked and
leaked by using the platform (of Telegram)," the Madras High
Court order dated Sept. 24 quoted Star as saying.
    Star made details of the lawsuit public for the first time
in a newspaper advertisement in The Hindu on Thursday.
    The court has issued notices to Telegram as well as
Cloudflare in the matter, and will next hear the case on Oct.
25. 
    The newspaper ad by Star stated the company had asked for
injunction restraining Telegram and Cloudflare from using the
trade name "Star Health" or making available any of its data
online.
    Star Health, Telegram and Cloudflare did not respond to a
Reuters request for comment.
    Reuters last week reported that an individual dubbed xenZen
had made stolen data including medical reports of Star customers
publicly accessible on Telegram, just weeks after Telegram's
founder was accused of allowing the app to facilitate crime.
    Star had earlier said its initial assessment showed "no
widespread compromise" was detected and that "sensitive customer
data remains secure".
    In testing the bots, Reuters downloaded more than 1,500
files with some documents dated as recently as July 2024, which
included policy and claims documents featuring names, phone
numbers, addresses, tax details, copies of ID cards, test
results, medical diagnoses and blood reports.
    Reuters shared details of the chatbots with Telegram on
Sept. 16 and within 24 hours spokesperson Remi Vaughn said they
had been "taken down". More chatbots appeared later.
    Star has also sued the purported hacker, xenZen, in the
lawsuit. The hacker in an email to Reuters on Thursday said they
will join the hearings online if permitted.

 (Reporting by Munsif Vengattil in Bengaluru; Editing by
Christopher Cushing and Shri Navaratnam)
 ((munsif.vengattil@thomsonreuters.com;))