A data breach does not end when the headlines fade.
For victims, stolen personal information can fuel fraud, identity theft and financial losses for years.
When a cyber breach makes headlines, discussions often revolve around the number of records compromised, regulatory penalties, or the financial impact on the affected organisation.
Far less attention is paid to the people whose personal information has been exposed. For them, the consequences often continue long after the headlines disappear.
A recent cyber incident involving one of India's leading health insurers illustrates this reality. In September 2024, a hacker allegedly put up for sale nearly 7.24 terabytes of customer data containing the personal records of over 31 million policyholders. Reports indicated that the leaked database included far more than names and phone numbers.
It reportedly contained PAN details, addresses, income tax documents, medical records, laboratory reports and diagnosis histories. Several policyholders later confirmed that their personal documents had indeed been exposed.
That is the part of a breach nobody talks about.
Medical fraud shows up first when health data is part of the breach. Someone else can use your diagnosis reports and insurance policy number to file a fake health insurance claim, book a treatment, or buy prescription drugs under your name.
Financial frauds tend to follow a familiar script.
Further, login attempts on your mail and your bank's app, since most people reuse passwords.
Then loans and SIM cards taken out using your PAN, surfacing months later as a recovery call or a dropped CIBIL score.
Under India's DPDP Act, 2023, the organisation that collected your data, known as the Data Fiduciary, remains responsible even if the breach occurred at a vendor. If the breach leads to financial fraud, you also have remedies under the IT Act.
India's DPDP Act governs the processing of digital personal data and gives individuals rights such as accessing, correcting or erasing their data, withdrawing consent, and seeking redress before the Data Protection Board.
Once the framework is fully operational, expected by May 2027, organisations must notify the Data Protection Board and affected individuals without delay after becoming aware of a data breach, followed by a detailed report to the Board within 72 hours.
Violations can attract penalties of up to Rs 250 crore.
Many Western countries have established similar privacy laws. The European Union's GDPR provide broad protection and require organisations to report qualifying breaches to regulators within 72 hours.
Affected individuals are notified only if the breach poses a high risk.
Under EU's GDPR, fines can reach 20 million euros or 4% of global turnover, whichever is higher. Notably, Meta was fined 1.2 billion euros in 2023.
Many companies buy a cyber security insurance policy to prepare for incidents like this. It is a very comprehensive coverage, covering the first party losses, including the business interruption, the forensic costs and the third party losses including the cover for financial damages to affected customers.
Many top Indian general insurance companies also offer personal cyber insurance to individuals, generally covering the theft of funds, identity theft, data or device restoration, cyber bullying and extortion, medical and credit card fraud, with credit monitoring and counselling included as reimbursable costs.
Common exclusions include cryptocurrency losses, risks you already knew about, and claims reported after the specified window.
The RBI has also given a Zero-Liability rule, under the 2017 framework: Once we report an unauthorised bank or UPI transaction within three working days of our bank's alert, the liability is usually zero.
From January 1, 2027, the RBI plans to extend this to five days and cover scams where one was tricked into approving payment -- digital arrest calls, phished OTPs, coerced UPI approvals.
For losses up to Rs 50,000, victims can claim back 85 percent, capped at Rs 25,000, once in a lifetime.
Oorjita Lath is the founder & CEO, Okube Advisors.