A data breach does not end when the headlines fade.
For victims, stolen personal information can fuel fraud, identity theft and financial losses for years.
Key points
- A major data breach can expose far more than names and phone numbers, with medical records, PAN details, addresses and financial documents potentially fuelling fraud long after the breach.
- Stolen health data can be misused for fake insurance claims, medical treatment or prescription purchases, while compromised credentials and PAN details can lead to account takeovers, loans and SIM fraud.
- Under India's DPDP Act, the organisation collecting personal data remains responsible for protecting it, while serious violations can attract penalties of up to Rs 250 crore.
- Cyber insurance can provide an additional layer of protection, covering risks such as financial fraud, identity theft, data restoration, device restoration, medical fraud and credit monitoring, depending on the policy.
- After receiving a breach alert, change compromised passwords, enable two-factor authentication, monitor bank and UPI transactions, check your credit report and report suspicious activity promptly.
When a cyber breach makes headlines, discussions often revolve around the number of records compromised, regulatory penalties, or the financial impact on the affected organisation.
Far less attention is paid to the people whose personal information has been exposed. For them, the consequences often continue long after the headlines disappear.
A recent cyber incident involving one of India's leading health insurers illustrates this reality. In September 2024, a hacker allegedly put up for sale nearly 7.24 terabytes of customer data containing the personal records of over 31 million policyholders. Reports indicated that the leaked database included far more than names and phone numbers.
It reportedly contained PAN details, addresses, income tax documents, medical records, laboratory reports and diagnosis histories. Several policyholders later confirmed that their personal documents had indeed been exposed.
That is the part of a breach nobody talks about.
Life After A Leak
Medical fraud shows up first when health data is part of the breach. Someone else can use your diagnosis reports and insurance policy number to file a fake health insurance claim, book a treatment, or buy prescription drugs under your name.
Financial frauds tend to follow a familiar script.
Further, login attempts on your mail and your bank's app, since most people reuse passwords.
Then loans and SIM cards taken out using your PAN, surfacing months later as a recovery call or a dropped CIBIL score.
Who Is Responsible?
Under India's DPDP Act, 2023, the organisation that collected your data, known as the Data Fiduciary, remains responsible even if the breach occurred at a vendor. If the breach leads to financial fraud, you also have remedies under the IT Act.
India's DPDP Act governs the processing of digital personal data and gives individuals rights such as accessing, correcting or erasing their data, withdrawing consent, and seeking redress before the Data Protection Board.
Once the framework is fully operational, expected by May 2027, organisations must notify the Data Protection Board and affected individuals without delay after becoming aware of a data breach, followed by a detailed report to the Board within 72 hours.
Violations can attract penalties of up to Rs 250 crore.
What Other Countries Have
Many Western countries have established similar privacy laws. The European Union's GDPR provide broad protection and require organisations to report qualifying breaches to regulators within 72 hours.
Affected individuals are notified only if the breach poses a high risk.
Under EU's GDPR, fines can reach 20 million euros or 4% of global turnover, whichever is higher. Notably, Meta was fined 1.2 billion euros in 2023.
How Insurance Fits In
Many companies buy a cyber security insurance policy to prepare for incidents like this. It is a very comprehensive coverage, covering the first party losses, including the business interruption, the forensic costs and the third party losses including the cover for financial damages to affected customers.
Many top Indian general insurance companies also offer personal cyber insurance to individuals, generally covering the theft of funds, identity theft, data or device restoration, cyber bullying and extortion, medical and credit card fraud, with credit monitoring and counselling included as reimbursable costs.
Common exclusions include cryptocurrency losses, risks you already knew about, and claims reported after the specified window.
The RBI's Zero-Liability Rule
The RBI has also given a Zero-Liability rule, under the 2017 framework: Once we report an unauthorised bank or UPI transaction within three working days of our bank's alert, the liability is usually zero.
From January 1, 2027, the RBI plans to extend this to five days and cover scams where one was tricked into approving payment -- digital arrest calls, phished OTPs, coerced UPI approvals.
For losses up to Rs 50,000, victims can claim back 85 percent, capped at Rs 25,000, once in a lifetime.
What To Do If You Get A Breach Message
- Change that password everywhere you used it.
- Turn on two-factor authentication.
- Freeze your credit report through CIBIL or Experian.
- Watch your bank and UPI statements for a full year, not a week.
- Report anything odd to your bank and to cybercrime.gov.in or the National Cybercrime helpline number 1930.
Staying Protected
- Use a unique password for every account and enable two-factor authentication wherever possible.
- Share your PAN or Aadhaar only when necessary and verify any unexpected request for personal or financial information before acting.
- As cyber threats continue to evolve, individuals may also consider purchasing a retail cyber insurance policy as an additional layer of financial protection against cyber fraud.
Oorjita Lath is the founder & CEO, Okube Advisors.
