Last month, a cyber-security startup told a major Indian online insurance brokerage it had found critical vulnerabilities in the company’s internet-facing network that could expose sensitive personal and financial data from at least 11 million customers to malicious hackers.
The startup followed the standard ethical-hacker playbook, giving Policybazaar, the insurance aggregator, time to patch the flaws and inform authorities. It did not seek authorization in advance to test Policybazaar’s system but said it considered itself justified, in part because it had employees who were customers.
