Loading story…
Star Health and Allied Insurance Company Limited remains under scrutiny over its 2024 hack-and-leak incident, in which authentic patient medical and diagnostic records were exposed through Telegram. The breach reportedly continued to result in data leakage despite court injunctions and was accompanied by threats directed at company executives and subsequent litigation.
India’s Insurance Regulatory and Development Authority imposed a ₹3.39 crore financial penalty over cybersecurity shortcomings. Public records also cite roughly 13,000 insurance-ombudsman complaints and contested GST liabilities, while criticism persists that Star Health has not fully accounted to affected policyholders for the exposure or demonstrated a confirmed remediation outcome.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Star Health and Allied Insurance Company Limited experienced a significant hack-and-leak incident in 2024. Authentic patient medical files, including diagnostic information and diagnoses, were exposed through Telegram.
India's Insurance Regulatory and Development Authority imposed a financial consequence on Star Health for cybersecurity shortcomings; the reported penalty was ₹3.39 crore.
Star Health pursued legal action against a researcher who had highlighted the company's security issues. The breach also led to lawsuits against or involving the insurer.
Data connected to the Star Health breach was reportedly leaked despite court injunctions intended to halt its disclosure. The incident also reportedly involved threats against company executives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Massachusetts-based ambulance billing and collections firm **Comstar** agreed to pay **$515,000** to settle allegations by the Massachusetts and Connecticut attorneys general that it violated **HIPAA** and state data security requirements following a **March 2022 ransomware attack**. Reporting indicates the intruder accessed Comstar’s network, **exfiltrated files**, and then **encrypted systems with ransomware**; exposed data included **names, Social Security numbers, driver’s license numbers, financial data, and medical/assessment information**. The incident ultimately affected **~585,621 individuals** (including large numbers of Massachusetts and Connecticut residents), and regulators cited failures such as not conducting a comprehensive risk analysis for **ePHI**; separate federal enforcement by **HHS OCR** was resolved via a **$75,000 penalty** and a corrective action plan. The Comstar case is being highlighted as a practical example that healthcare breaches can trigger **stacked consequences**—federal enforcement, **state AG actions**, and **class-action litigation**—in addition to extortion demands from ransomware operators. The breach’s downstream impact extended to organizations that had used Comstar as a vendor years earlier, with some providers reporting that their patients’ data was implicated even if the provider was no longer a Comstar client at the time of the incident. Separate reporting on class-action settlements involving Texas and New Jersey dermatology practices concerns different incidents and does not materially add to the Comstar enforcement story.
Jun 29, 2026
**Bell Ambulance** reported that a February 2025 network intrusion led to the compromise of protected health information for **237,830 individuals**, after unauthorized activity was detected on **Feb. 13, 2025**. The organization said the exposed data can include **names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information**; it offered **12–24 months** of credit monitoring/identity protection and stated it was not aware of misuse at the time of notification. The incident response included third-party forensic support, and notifications were issued in phases as the data review progressed, with additional letters sent into March 2026. Separately, **Cornerstone Specialty Hospitals** agreed to pay **$2.35 million** to settle a class action lawsuit tied to a data breach that reportedly affected **nearly 500,000 individuals**. The available reporting focuses on the settlement amount and impacted population size, indicating ongoing legal and financial consequences for large-scale healthcare data exposure even when technical details of the underlying intrusion are not publicly described in the same source.
Jun 29, 2026
French healthcare software provider **Cegedim Santé** confirmed a major breach affecting its *MonLogicielMedical (MLM)* product after unusual activity was detected in late 2025. The incident exposed administrative data tied to roughly **1,500 doctors** (out of ~3,800 users) and patient data at large scale—reported as **15.8 million records**, including **165,000 files** that may contain doctors’ notes; while structured medical records were reported as intact, some administrative comments may include sensitive clinical notes and highly sensitive details (e.g., HIV/AIDS status or sexual orientation). Cegedim Santé reported notifying French authorities including **CNIL** and filing a complaint. In the US, **Cornerstone Specialty Hospitals** agreed to a **$2.35M** class-action settlement tied to a **December 2023** network intrusion that ultimately affected **484,957 individuals**, with potentially exposed data spanning identifiers (including SSNs and government IDs), financial data, credentials, and health/insurance information; the suit also alleged delayed notification (letters mailed around July 2024). Separately, **PIH Health** began notifying patients about a **December 2024 ransomware attack** that disrupted multiple hospitals and services; investigators concluded the attacker had network access from **Nov 14–Dec 23, 2024**, and after a prolonged review PIH Health confirmed in **Dec 2025** that patient information was present in files on compromised systems and may have been accessed or acquired, with notification letters prepared by **Feb 25, 2026** amid claims of large-scale data theft and some data leakage online.
Jun 29, 2026