The hacker responsible for leaking sensitive personal data from Star Health and Allied Insurance Company has now taken credit for sending death threats and bullets to the company’s top executives. Operating under the alias “xenZen“, the hacker outlined the threats in a March 31 email to Reuters, confirming the disturbing actions in retaliation for the company’s treatment of its customers.
Hacker Claims Responsibility for Death Threats
According to the email sent to Reuters, xenZen disclosed that they had sent bullet cartridges to Star Health’s headquarters in Chennai, Tamil Nadu, earlier this year. The packages, addressed to Anand Roy, the CEO, and Nilesh Kambli, the CFO, contained bullets along with a chilling note that read: “next one will go in ur and ur peoples head. tik tik tik.” XenZen claimed that these actions were in response to the company’s refusal to honor medical claims from certain clients.
XenZen’s email, the content of which Reuters is reporting for the first time, also included photos of the two packages and details about their delivery. The hacker’s motives appear to stem from the company’s denial of coverage to clients with legitimate health insurance claims, an issue that xenZen claimed led them to act violently against Star Health executives.
The Data Breach and Its Aftermath
This series of threats follows the data breach that rocked Star Health last year. In September 2023, xenZen revealed that they had stolen 7.24 terabytes of sensitive customer data, including medical records, of over 31 million individuals covered by the insurer. At the time, the hacker also stated that they were in talks with potential buyers for the data, which had been leaked and made public.
Star Health has faced significant criticism from both data security experts and customers after these revelations. Many clients expressed outrage over the breach of their sensitive medical information, while experts pointed to lapses in the company’s data security measures.
In response to the latest claims, Star Health’s chief legal officer declined to comment, citing an ongoing criminal investigation into the leak. The company has yet to issue a statement regarding the death threats or xenZen’s motive.
Police Investigation and Arrests
The Tamil Nadu police have confirmed that an investigation is underway concerning the death threats sent to Star Health executives. Authorities have also linked these threats to the hacker xenZen. In the most recent development, reports indicate that a man from the neighboring state of Telangana has been arrested for allegedly assisting xenZen in mailing the threatening packages.
Local police have not disclosed the identity of the suspect or the details of his detention, but sources have confirmed that the investigation is active and ongoing. However, Tamil Nadu police did not respond to Reuters’ requests for further comments regarding the investigation.
Repercussions and the Broader Impact on the Healthcare Industry
This incident has raised concerns about the safety and security of top executives in the healthcare sector. The recent murder of UnitedHealthcare CEO Brian Thompson in a targeted attack in December has intensified the focus on the risks faced by leaders in this industry, especially in light of growing public dissatisfaction with health insurance companies.
In xenZen’s March email, the hacker referenced Thompson’s killing, suggesting that their actions against Star Health’s leadership were similarly motivated by frustration over denied medical claims. XenZen claimed that they were contacted by Star Health customers who felt wronged by the company’s refusal to honor valid claims despite the customers being covered under its policies.
Despite these claims, Star Health has not commented on the validity of the allegations regarding denied medical claims. The company did not respond to Reuters’ inquiries about xenZen’s motives or the ongoing investigation into the death threats.
Ongoing Legal Proceedings
The controversy surrounding Star Health’s data leak continues to unfold in the courts. In response to the breach, Star Health filed a lawsuit in September 2023 against xenZen and Telegram, accusing the messaging platform of hosting the stolen customer data. The chatbots on Telegram that were found to have hosted the leaked data were subsequently deleted. However, the legal case remains unresolved.
The company’s investigation into the breach initially revealed that the hacker had demanded a ransom of $68,000 in exchange for not releasing the data. The breach and the subsequent threats against Star Health’s leadership have raised serious questions about the effectiveness of data protection measures in the health insurance industry.
As the investigation continues and more details emerge, the fallout from this case could have far-reaching implications for both the security of personal data and the safety of corporate leaders within the healthcare sector. The incident underscores the vulnerability of sensitive data and the escalating risks faced by companies in today’s digital age.
