**Executive Summary:**
The Ministry of Electronics and Information Technology addressed concerns regarding a data breach at Star Health and Allied Insurance in August 2024, as well as broader cybersecurity measures. CERTIn investigated the Star Health breach, notified the organization, and coordinated response measures, forwarding technical analysis details to Tamil Nadu Police. The government emphasizes ongoing efforts to strengthen cybersecurity through various initiatives, including CERTIn's role, the National Cyber Coordination Centre, and collaborative efforts with other agencies. The Digital Personal Data Protection Act, 2023, has been enacted to safeguard personal data, mandating security measures and penalties for breaches.
**Key Points / Main Content:**
* **Star Health Data Breach:**
* CERTIn received a report of a data breach at Star Health and Allied Insurance in August 2024.
* CERTIn notified Star Health and coordinated incident response measures.
* Technical analysis details were sent to Tamil Nadu Police for investigation.
* **Cybersecurity Strengthening Measures:**
* CERTIn is the national agency for responding to cybersecurity incidents (Section 70B of the Information Technology Act, 2000).
* The National Cyber Coordination Centre (NCCC) project is implemented by CERTIn to detect and share cybersecurity threat information.
* CERTIn collaborates with agencies like TSOC, I4C, and NCIIPC.
* Successful prevention of cyberattacks during major events like the G20 summit, Parliament 20 summit, Ram Janmabhoomi event, Maha Kumbh etc.
* Regular training workshops are conducted for cybersecurity professionals and other stakeholders.
* IRDAI issues cybersecurity guidelines for regulated entities in the insurance sector.
* CERTIn operates a cyber threat intelligence exchange platform.
* Cybersecurity mock drills are regularly conducted.
* **Legal Provisions for Data Protection:**
* The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) mandates security practices for handling sensitive personal data.
* The Digital Personal Data Protection Act, 2023 (DPDP Act) has been enacted to safeguard personal data.
* The DPDP Act mandates technical and organizational measures for data processing and security safeguards to prevent breaches.
* The Data Protection Board may impose monetary penalties for breaches, up to two hundred and fifty crore rupees.
**Impact Analysis:**
* **Star Health and Allied Insurance:**
* *Impact:* Experienced a data breach requiring remediation.
* *Action Required:* Must implement remedial actions as notified by CERTIn and cooperate with the Tamil Nadu Police investigation.
* **Indian Computer Emergency Response Team (CERTIn):**
* *Impact:* Plays a central role in responding to cybersecurity incidents and coordinating national cybersecurity efforts.
* *Action Required:* Continue to monitor cyber threats, coordinate with stakeholders, and enforce cybersecurity measures.
* **Insurance Regulatory and Development Authority of India (IRDAI):**
* *Impact:* Responsible for issuing cybersecurity guidelines for the insurance sector.
* *Action Required:* Ensure regulated entities comply with cybersecurity guidelines.
* **Organizations Handling Personal Data:**
* *Impact:* Must comply with the Digital Personal Data Protection Act, 2023, to protect personal data.
* *Action Required:* Implement appropriate technical and organizational measures to prevent data breaches and ensure lawful data processing.
* **Individuals (Data Principals):**
* *Impact:* The DPDP Act aims to safeguard their personal data and ensure it is processed lawfully.
* *Action Required:* Exercise their rights under the DPDP Act, including lodging complaints regarding data breaches or rights violations.
Key Entities Referenced
Star Health and Allied Insurance: An insurance company that experienced a data breach involving customer data.
Indian Computer Emergency Response Team CERTIn: The national cyber agency responsible for responding to cyber security incidents in India as per Section 70B of the Information Technology Act.
Information Technology Act, 2000: An Act of the Indian Parliament to provide legal framework to recognize electronic transactions and for matters connected therewith or incidental thereto.
Digital Personal Data Protection Act, 2023: An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
National Cyber Coordination Centre NCCC: A project implemented by CERTIn to examine cyberspace and detect cyber security threats.
Telecom Security Operations Centre TSOC: An agency involved in ensuring cybersecurity, working with CERTIn.
India Cyber Crime Coordination Centre I4C: An agency involved in ensuring cybersecurity, working with CERTIn.
Insurance Regulatory and Development Authority of India IRDAI: An authority that issues cybersecurity guidelines for regulated entities including insurers.
GOVERNMENT OF INDIA
MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY
LOK SABHA
UNSTARRED QUESTION NO. 564
TO BE ANSWERED ON: 23.07.2025
DATA BREACH BY STAR HEALTH ALLIANCE
564. DR. BACHHAV SHOBHA DINESH:
Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:
(a) whether the Government has taken cognisance of the fact that there was a data breach by Star
Health and Allied Insurance which led to highly sensitive personal information including names,
phone numbers, residences, tax information, ID copies, test results and diagnoses of Star Health
customers being shared on Telegram;
(b) whether as per the Section 70B of the Information Technology Act, the national cyber agency
Indian Computer Emergency Response Team (CERT-In) has initiated a probe into the data breach
and if so, the details thereof including findings of the investigation;
(c) whether the Government has initiated any punitive action against those responsible for the
cause and if so, the details thereof;
(d) whether the rules under the Digital Personal Data Protection Act, 2023, have been notified and
if so, the details thereof; and
(e) whether the Government has formulated concrete policies to ensure prevention of such
incidents in the future and if so, the details thereof?
ANSWER
MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY
(SHRI JITIN PRASADA)
(a) to (e): In August 2024, Indian Computer Emergency Response Team (CERT-In) received a
report regarding data breach at Star Health and Allied Insurance. CERT-In notified the affected
organisation along with remedial actions to be taken, and coordinated further incident response
measures. CERT-In has sent the details of the technical analysis to Tamil Nadu Police for further
investigation.
Government remains cognizant and aware of cyber threats and challenges including those of
insurance sector. Following measures have been taken to strengthen cybersecurity in the country:
• The Indian Computer Emergency Response Team (CERT-In) is designated as the national
agency for responding to cyber security incidents under the provisions of section 70B of the
Information Technology Act, 2000.
• National Cyber Coordination Centre (NCCC) project is being implemented by CERT-In.
NCCC examines the cyberspace to detect cyber security threats. It shares the information with
concerned organizations, state governments and stakeholder agencies for taking action.• CERT-In works with other agencies involved in ensuring cybersecurity including Telecom
Security Operations Centre (TSOC), India Cyber Crime Coordination Centre (I4C), National
Centre Information Infrastructure Protection Centre (NCIIPC), etc.
• CERT-In along with other agencies was able to successfully prevent cyber-attacks during the
G20 summit, Parliament 20 summit, Ram Janmabhoomi event, Maha Kumbh etc.
• Regular training workshops are conducted for cybersecurity professionals, government
employees, police and law enforcement professionals, lawyers and public prosecutors,
students, etc.
• The Insurance Regulatory and Development Authority of India (IRDAI) also issues
cybersecurity guidelines for regulated entities including insurers, brokers, corporate agents,
etc.
• CERT-In operates an automated cyber threat intelligence exchange platform for sharing
tailored alerts with organisations across sectors for proactive threat mitigation.
• Cyber security mock drills are conducted regularly to enable assessment of cyber security
posture and preparedness of organisations in Government and critical sectors
Legal provisions:
• In order to ensure data protection, the Information Technology (Reasonable Security Practices
and Procedures and Sensitive Personal data or Information) Rules, 2011 (‘SPDI Rules’)
mandates reasonable security practices and procedures for body corporate or any person on its
behalf, handling sensitive personal data or information.
• In order to safeguard the personal data of individuals and ensure that their data is shared only
with their consent, the Digital Personal Data Protection Act, 2023 (DPDP Act) has been
enacted. The DPDP Act is aimed at safeguarding the personal data of individuals and ensuring
processing of personal data for the lawful purposes.
• As per the Act, appropriate technical and organisational measures must be implemented for
processing of the personal data and reasonable security safeguards must be taken to prevent
any personal data breach.
• Further, in the event of any such breach or complaint by the Data Principal with respect to
exercise of her rights, the Data Protection Board after an inquiry, may impose monetary penalty
as per the provisions of the Act. The Act prescribes different monetary penalties for different
types of breaches of the Act, with the maximum penalty upto two hundred and fifty crore
rupees.
******