VULNpocalypse
Breaches and incidents

Star Health and Allied Insurance (India): IRDAI fines Rs 3.39 crore under its cyber security guidelines after the 2024 leak

Star Health’s exchange filing of 26 Jul 2025: an IRDAI order dated 25 Jul 2025 levied Rs 3,39,00,000 under the IRDAI Information and Cyber Security...

Disclosed
Verification
Checked against a primary source

What happened

  • Star Health’s exchange filing of 26 Jul 2025: an IRDAI order dated 25 Jul 2025 levied Rs 3,39,00,000 under the IRDAI Information and Cyber Security Guidelines, 2023, for “certain aspects pertaining to safeguard of data and cyber security”, with directions to comply. Outlook Money reports the regulator found late reporting and weak early detection and ordered an IT audit (not in the filing).
  • Earlier in 2025: packages with bullet cartridges and a threatening note reached Star Health’s Chennai office in February, addressed to CEO Anand Roy and CFO Nilesh Kambli. “xenZen” claimed them in an email to Reuters on 31 Mar; Star Health declined comment citing an “ongoing, highly sensitive criminal investigation” (Insurance Business, citing Reuters).
  • Root cause: not publicly established in the sources checked; the order text is not public.
  • Attacker: xenZen (self-claimed, both the 2024 leak and the threats).
  • Response: penalty and directions from IRDAI; police investigation into the threats.

Sources