Star Health Insurance data leak: Madras High Court orders Telegram to delete chatbots, posts

The Madras High Court on October 25 directed Telegram to immediately block and delete any posts or ‘chatbots’ flagged by Star Health Insurance for leaking its customer data recently. 

In an interim order, Justice K Kumaresh Babu directed Star Health Insurance to “send an email with the username and the URL from which such bots are posted so Telegram can block and delete them”, according to a Bar and Bench report. 

The court was hearing a petition filed by Star Health against Telegram and five others. The High Court gave the direction after Telegram said it was unable to search for leaks on its own but agreed to delete the leaked data if the insurer gave them details. 

Telegram’s legal counsel said that the platform could remove specific accounts if the company provides concrete evidence that certain accounts were involved in data leaks. 

The lawyer added that while Telegram can take action with adequate proof, it cannot do ‘policing work’ by independently monitoring content, Reuters reported. 

The court further observed that on social media platforms like Telegram, anyone can make posts using VPN from other countries. “Anyway, the damage will be done because they can't block unless it is posted,” the bench said. 

Earlier in September, Star Health had filed a lawsuit against Telegram and a hacker. According to the lawsuit, chatbots on Telegram were being used to leak personal data and medical reports of about 3 crore Star Health policyholders. 

Star Health, India’s biggest health insurer, received a ransom demand of $68,000 from a cyberhacker in connection with a leak of customer data and medical records, as per the Reuters report. 

Telegram has declined to share the account details or permanently ban accounts linked to the hacker - an individual dubbed xenZen - “despite multiple notices issued in this regard,” Star Health said. The insurer said it has “sought the assistance” of Indian cyber security authorities to “help us identify” the hacker. 

Telegram also submitted that it was not empowered under the Information Technology Act or the concerned Rules to take down all accounts that were posting data related to Star Health.