HDFC Life Insurance files police case against data theft, extortion

MUMBAI: A case has been registered by HDFC Life Insurance Company Ltd at the cyber crime department of Mumbai Police against unknown cyber frauds, who allegedly stole the company’s customer data and started demanding money by threatening to leak the same. The company has also informed the stock exchange in its filing that there was a data leak, and it has started an inquiry into it with the help of experts.
The case was registered by Jovita Desai, associate vice-president, Legal, HDFC Life Insurance Company Ltd.
“The company has an office in Apollo Mills Compound in Mahalaxmi area. On 19 November 2024, the company received mails on various email ids stating that the company’s customer data had been breached. The sender gave two days to the company to contact him for negotiations, threatening to sell the data if the company failed to do so,” said a police officer, adding that details of 99 customers of the company were attached to the mails. The leaked data contains names, policy numbers, addresses, and mobile numbers of customers apart from other details.
The company continued to receive warning mails and messages throughout 20-21 November. “If you choose to negotiate, it goes without saying that this will prevent you from suffering losses of hundreds of billions of rupees in terms of customer data leakage, reputation, stock market and regulatory pressure,” read one message.
After the company confirmed with the help of experts that the sender was a hacker and was trying to blackmail the company by demanding money in the form of extortion, it decided to approach the police and, also, inform the regulatory authorities. It also started a detailed investigation in consultation with information security experts to take necessary remedial action.
“We will take utmost care to handle the concerns of our customers and take actions to safeguard their interests,” HDFC Life stated in its regulatory filing.
Police have registered a case under sections 308 (3) (extortion) and 351 (4) (criminal intimidation) of the Bharatiya Nyaya Sanhita, 2023, and relevant sections of the Information Technology Act, 2000.