Breaches and incidents
Niva Bupa Health Insurance (India): xenZen claims customer and claims data, runs a leak site
On 20 Feb 2025 the attacker emailed executives claiming access to customer data and insurance claims “until February 2025”, with a link to...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- On 20 Feb 2025 the attacker emailed executives claiming access to customer data and insurance claims “until February 2025”, with a link to NivaBupaLeaks.com and a password, and demanded a ransom; further messages on 21 and 22 Feb cited a policy issued on 21 Feb (MediaNama, from court records). Niva Bupa confirmed receiving the email and said it was “urgently treating the matter” without disclosing scale (Teiss).
- Root cause: not disclosed.
- Attacker: xenZen, the actor behind the 2024 Star Health leak.
- Response: cyber crisis plan activated, external investigators, FIR, regulators informed. The Delhi High Court ordered the leak site blocked, the attacker’s emails taken down, the registrar and authorities to disclose KYC and IP details, and no future domains containing “Niva Bupa”.