Mumbai Police have launched an extensive investigation into a major data theft incident involving a top Indian life insurance company. Cybercriminals gained unauthorized access to the company’s sensitive customer data and issued a ransom demand, threatening to leak it unless paid.
The cybercrime unit arrested 28-year-old interior designer, Divesh Kumar Dutta, from Haryana. However, the main suspect, identified only as “Robert,” is believed to be operating from Cambodia and remains at large.
The sequence of events began when the company received a threatening email claiming that a large volume of customer data had been leaked. The message also included a sample attachment featuring the details of 99 policyholders. The following day, the insurance company received additional threats, warning that failing to negotiate would result in severe financial losses due to the leak, impacting reputation, stock market value, and regulatory scrutiny.
In response, the company engaged with the sender, sharing contact details to negotiate. On November 21, further threats were received via WhatsApp. Recognizing the gravity of the situation, the company’s legal team filed a complaint with the Mumbai Cyber Police.
The internal investigation by the company’s IT team traced the source of the breach to a policyholder account, revealing that Dutta had purchased a policy for Rs1,000. By using this account, he gained unauthorized access to confidential customer data, which was allegedly sold on the dark web.
Dutta confessed to police that he was acting under the instructions of “Robert,” who directed him to purchase the policy and extract the data. The arrested suspect is now in custody, while the police continue to track down Robert, believed to be orchestrating the cybercrime from Cambodia.
The breach has caused significant financial and reputational damage to the insurance company, though it has yet to publicly comment on the incident due to the ongoing investigation. Meanwhile, the Mumbai Cyber Police continue to unravel the complexities of this transnational cybercrime case.
This incident highlights the growing threat of data breaches and the urgent need for robust cybersecurity practices in an increasingly digital world.