Security firm finds flaws in Indian online insurance broker

Aug 10, 2022, 3:37 AM | Updated: Aug 12, 2022, 3:01 pm

A man looks at the website of policybazaar website at a local insurance company office in Mumbai, I...

A man looks at the website of policybazaar website at a local insurance company office in Mumbai, India, Wednesday, Aug. 10, 2022. A cybersecurity firm told the major Indian online insurance brokerage last month that critical vulnerabilities in the company’s internet-facing network could expose sensitive personal and financial data from its 11 million customers. CyberX9 followed the standard ethical-hacker playbook, giving the brokerage time to patch the flaws and inform authorities. A week later, publicly traded Policybazaar said it had been illegally breached but “no significant customer data was exposed.” (AP Photo/Rafiq Maqbool)

(AP Photo/Rafiq Maqbool)

NEW DELHI (AP) — Last month, a cybersecurity startup told a major Indian online insurance brokerage it had found critical vulnerabilities in the company’s internet-facing network that could expose sensitive personal and financial data from at least 11 million customers to malicious hackers.

The startup followed the standard ethical-hacker playbook, giving Policybazaar, the insurance aggregator, time to patch the flaws and inform authorities. It did not seek authorization in advance to test Policybazaar’s system but said it considered itself justified, in part because it had employees who were customers.

A week later, on July 24, Policybazaar, which is publicly traded and counts the Chinese conglomerate Tencent among its investors, notified India’s stock exchanges it had been illegally breached but “no significant customer data was exposed.”

It said little more.

The startup, CyberX9, is not keeping quiet. Its managing director wants Indians to know that the “multiple extremely critical” vulnerabilities were so easy to find it was almost as if Policybazaar intentionally left itself open to criminal or nation-state intrusion .

“It would’ve been extremely easy for anyone with good computer/IT knowledge to discover, exploit, and leak all of this data,” CyberX9 director Himanshu Pathak said.

The data include not just names, home and email addresses, dates of birth and phone numbers but what people must show to get insurance: digital copies of identification, health and financial documents including tax returns, pay slips, bank statements, driver licenses and birth certificates, CyberX9 said.

A broker for multiple carriers and types of policies that claims 90% of India’s online insurance aggregator market, Policybazaar amasses data through user uploads and self-generated records. It included questionnaires that Indian armed forces members filled out — the company offers various insurance policies tailored to them — listing their ranks, branch of service, and whether they work in danger zones and handle weapons and explosives.

The Associated Press reached three people listed in sample data including copies of sensitive personal documents provided by CyberX9, one a soldier stationed in Ladakh, a region in dispute with Pakistan and China. All three confirmed they were Policybazaar customers. All said they had not been made aware of any security incident.

According to documents on the website of Policybazaar’s parent company, PB Fintech Ltd., 56 million people were registered on the site at the end of December, including 11 million “transacting customers” who purchased 25 million insurance policies.

Policybazaar would not respond to questions from the AP, other than to say it had fixed the identified vulnerabilities and referred the incident to external advisers for a forensic audit.

It did not confirm that CyberX9 had alerted it to the vulnerabilities, describe how its IT system was “subject to illegal and authorized access” or explain what customer data was exposed. Policybazaar said the flaws were identified on July 19, the day after CyberX9 says it first alerted the brokerage.

Pathak provided the AP with copies of his email exchanges with India’s Computer Emergency Response Team (CERT-IN), which said on July 25 that Policybazaar reported the vulnerabilities had been fixed, and with a national cyber security official, Lt. Gen. Rajesh Pant, who told Pathak in a July 26 email: “Thanks for informing. Shall initiate action against Policy Bazaar.”

Neither CERT-IN nor Pant responded to AP emails seeking comment.

CyberX9 said it decided to probe Policybazaar’s network for flaws after learning during its November IPO how much sensitive and confidential data the company was managing.

It said it found five vulnerabilities and was able to retrieve user data with no authorization check — and there were no restrictions on how many times an unauthorized user could make such a retrieval.

The researchers tested the vulnerabilities “by fully automating them using very simple scripts, all of this without facing any viable restrictions by your systems,” CyberX9 told Policybazaar in the technical report it sent the company last month.

“Considering the simplicity and ease of discovery and exploitation of these vulnerabilities, Policybazaar have clearly left the doors open to threat actors to invade the lives of its users.”

It was unclear whether CyberX9 will face any legal repercussions for probing Policybazaar’s system.

The incident highlights India’s “complicated, messed-up” cybersecurity environment, where government officials often do not follow up to ensure better-protected networks, said Raman Jit Singh Chima, Asia policy director for the online rights nonprofit group AccessNow.

He said he believed Policybazaar made the vulnerability disclosure because insurance and securities regulators require it.

In India, as elsewhere, good-faith security researchers intent on preventing malicious hacks and ransomware attacks must tread carefully as they are constrained by vague computer crime laws. India’s laws draw no distinctions in malice and ethics when it comes to identifying and exploiting weaknesses in software code.

“There is ambiguity in the law — it says you can’t test without permission and only after that can you probe,” said Apar Gupta, executive director of the nonprofit Internet Freedom Foundation.

CERT-IN issued a responsible disclosure policy in September offering good-faith hackers guidelines, he said, but it includes a disclaimer that nods to the ambiguity. U.S. law is also ambiguous, though the U.S. Justice Department announced a new policy in May directing that “good-faith security research should not be charged.”

That means the system favors the brash and the bold, who better also have good lawyers.

Security experts said it seems the CyberX9 researchers, as Policybazaar customers, had good cause to probe the company’s digital edifice for easily exploited flaws as long as they did it responsibly.

In its report to Policybazaar, CyberX9 said it would be pleased to receive a so-called “bug bounty” reward — which some companies customarily pay researchers for good-faith flaw identification — “though it is not necessary.”

Pathak said no such reward was paid.

India, with 800 million internet users, also does not have a data protection law even though the country’s top court in 2017 held privacy as a fundamental right and directed the government to draw up legislation. In Parliament, the bill was delayed by criticism over some provisions, including one that gave the government access to personal data in the name of “sovereignty.”

Last week, Parliament withdrew the legislation, saying it would start the process anew.

Digital experts say a data protection law is necessary in India where financial fraud and data leaks are rampant. Its absence has exacerbated privacy concerns in the country, where past incidents have seen both private companies and the government leak people’s data.


Bajak reported from Boston.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


FILE - Crystal Baziel holds the Pan-African flag Monday, June 19, 2023, during Reedy Chapel A.M.E C...

Associated Press

The beginner’s guide to celebrating Juneteenth

For more than one-and-a-half centuries, the Juneteenth holiday has been sacred to many Black communities. It marks the day in 1865 enslaved people in Galveston, Texas found out they had been freed — after the end of the Civil War, and two years after President Abraham Lincoln’s Emancipation Proclamation. Since it was designated a federal […]

5 hours ago

A Boeing 737 Max suffered damage to parts of the plane's structure after it went into a “Dutch ro...

Associated Press

Plane that did ‘Dutch roll’ on flight from Phoenix suffered structural damage, investigators say

A Boeing 737 Max suffered damage to parts of the plane's structure after it went into a “Dutch roll” during a flight from Phoenix last month.

5 days ago

This photo provided by Randy Shannon shows Mooney Falls on the Havasupai reservation outside the vi...

Associated Press

Dozens report illness after trips to waterfalls near Grand Canyon

Dozens of hikers say they fell ill during trips to a popular Arizona tourist destination that features towering blue-green waterfalls deep in a gorge neighboring Grand Canyon National Park.

6 days ago

Mugshot of Rudy Giuliani, who was processed Monday, June 10, 2024, in the Arizona fake electors cas...

Associated Press

Rudy Giuliani posts $10K cash bond after being processed in Arizona fake electors case

Rudy Giuliani, a former New York City mayor and Donald Trump attorney, was processed Monday in the Arizona fake electors case.

8 days ago

FILE - White House former chief of staff Mark Meadows speaks with reporters at the White House, Wed...

Associated Press

Former Trump chief of staff Mark Meadows pleads not guilty in Arizona fake elector case

Former Donald Trump presidential chief of staff Mark Meadows and Trump 2020 Election Day operations director Michael Roman pleaded not guilty Friday in Phoenix to nine felony charges for their roles in an effort to overturn Trump's Arizona election loss to Joe Biden.

12 days ago

deadly heat wave last summer...

Associated Press

After a deadly heat wave last summer, metro Phoenix is changing tactics

Fresh memories of the deadly heat wave last summer have led Arizona authorities to launch new tactics ahead of summer 2024.

22 days ago

Sponsored Articles


Midwestern University

Midwestern University Clinic visits boost student training & community health

Going to a Midwestern University Clinic can help make you feel good in more ways than one.


Day & Night Air Conditioning, Heating and Plumbing

Beat the heat, ensure your AC unit is summer-ready

With temperatures starting to rise across the Valley, now is a great time to be sure your AC unit is ready to withstand the sweltering summer heat.


Collins Comfort Masters

Here’s 1 way to ensure your family is drinking safe water

Water is maybe one of the most important resources in our lives, and especially if you have kids, you want them to have access to safe water.

Security firm finds flaws in Indian online insurance broker