Security firm finds flaws in Indian online insurance broker

By KRUTIKA PATHI, SHEIKH SAALIQ and FRANK BAJAK
Associated Press

NEW DELHI (AP) — A cybersecurity startup informed a major Indian online insurance brokerage last month that critical vulnerabilities in its network could expose sensitive personal and financial data from at least 11 million customers. CyberX9 followed the standard ethical-hacker playbook, giving the brokerage time to patch the flaws and inform authorities. A week later, the insurance brokerage, Policybazaar, said it had been illegally breached but “no significant customer data was exposed.” It said little more. CyberX9 wants Indians to know the broker had multiple critical vulnerabilities that left itself open to intrusion. The incident highlights the gray area in which many security researchers operate when computer crime laws such as India’s make no adjustment for good-faith work.