Major Data Breach at HDFC Life Insurance Company: Cyberattackers Operating from Hong Kong and Singapore Demand Ransom, Investigation Underway

Mumbai: A significant data breach at HDFC Life Insurance Company Limited has come to light, with initial investigations by the Mumbai Cyber Cell revealing that the theft was carried out by an unidentified individual operating from Hong Kong and Singapore. The stolen data reportedly includes sensitive customer information, such as policy numbers, names, addresses, mobile numbers, and other confidential details.

The breach occurred between November 19 and 21, 2024, with the perpetrator using the email address bsdqwasdg@gmail.com and WhatsApp to inform HDFC Life about the stolen data. The individual demanded a ransom and threatened to sell the stolen information if the demand was not met. The first threatening email, sent on November 19 at 4:54 PM, read: "A large amount of your customers' data has leaked. You have two days to respond. If I don’t hear from you by tomorrow, I will sell the data." The email also included the details of 99 affected customers.

As the company began investigating the breach, a second email was received on November 20 at 11:51 AM. In response, HDFC Life immediately filed a complaint with the Cyber Cell, which has since launched a detailed probe into the incident.

HDFC Life's Statement

In an official statement, HDFC Life acknowledged the breach, saying:
"We have received communication from an unidentified source who maliciously shared some data fields of our customers with us. We value the privacy of our customers’ data and have initiated a thorough investigation in consultation with information security experts to assess the root cause and take corrective actions as necessary."

Expert Opinions

Cybersecurity expert and lawyer Prashant Mali emphasized the seriousness of the breach and said, "Data leaks signify a betrayal of customers due to negligence in cybersecurity. The RBI should impose a hefty penalty on HDFC to ensure stricter cybersecurity measures in the future."
Former IPS officer P.K. Jain highlighted a legal hurdle, noting, "Police action against HDFC can only proceed if a customer files a formal complaint alleging that their data was leaked. Without such a complaint, no legal action can be taken."

Previous Incidents

This breach comes just weeks after two major health insurance companies also reported data breaches, prompting the Insurance Regulatory and Development Authority of India (IRDAI) to order cybersecurity audits across the industry.​