Star Health hacker says they sent death threats, bullets to India executives

The hacker who leaked sensitive personal data held by Indian health insurer Star Health last year has taken responsibility for sending death threats and bullets to the company’s chief executive and finance head.

The hacker who leaked sensitive personal data held by Indian health insurer Star Health last year has taken responsibility for sending death threats and bullets to the company's chief executive and finance head.

The hacker, who goes by the alias "xenZen", described their reprisals against Star Health and Allied Insurance Company in a March 31 email to Reuters. The news agency is reporting them for the first time.

Star Health, India's biggest health insurer, has faced criticism from customers and data security experts since Reuters reported last September that xenZen had leaked sensitive client data, including medical reports. At the time, xenZen told Reuters in an email they possessed 7.24 terabytes of data related to over 31 million Star Health customers and was speaking to potential buyers for the data.

The news agency hasn't independently confirmed the identity or location of xenZen, the accuracy of the facts laid out in the March 31 email or the hacker's motive for targeting Star Health and its executives, which the email ascribed to the company's denial of medical claims to certain customers.

In response to questions from Reuters, Star Health's chief legal officer said in a statement the company could not comment "due to an ongoing, highly sensitive criminal investigation" related to its data leak. XenZen said they had concealed bullet cartridges in two packages sent to Star Health's head office in the southern Indian city of Chennai, in Tamil Nadu state, in February.

The email included photographs that showed the packages addressed to Chief Executive Anand Roy and Chief Financial Officer Nilesh Kambli and a note inside which read: "next one will go in ur and ur peoples head. tik tik tik."

Roy did not respond to a phone call requesting comment, while Kambli told Reuters Star Health's public relations team would respond on his behalf. The company did not respond to further requests for comment.