A simple password mistake led to 5.3 million leaked health records

Cybernews reports its investigation teams recovered a 500GB unprotected database of a Mexican wellness attraction institution connected August 26, 2024. The database exposes delicate accusation specified arsenic names, individual recognition numbers (CURP), telephone numbers, descriptions of costs requests, and more.

The full magnitude of affected group adds up to 5.3 million, making up astir 4% of nan country’s population, arsenic Cybernews notes. The Cybernews study indicates that nan information correction occurred pinch a “misconfigured” usage of a information visualization instrumentality called Kibana, which appears to person been near unauthenticated.

The monolithic measurement of information was later credited to Ecaresoft, a Texas-based package institution down cloud-based Hospital Information Systems specified arsenic Anytime and Cirrus. More than 30,000 doctors, 65 hospitals, and 110 outpatient attraction centers usage Ecaresoft services to negociate tasks specified arsenic assignment booking, medicine management, inventory management, and more.

Other stolen information includes ethnicities, nationalities, religions, humor types, dates of birth, gender, email addresses, nan magnitude charged for wellness attraction services, and nan hospitals visited. This clip around, threat actors are not to blasted arsenic nan cause. There is nary charismatic accusation astir whether nan affected users are alert of nan business aliases really agelong nan database (now taken down) was up and running.

The affected users’ wellness records were not taken, but pinch their Mexican authorities recognition (equivalent to nan U.S. Social Security number) astatine risk, they are exposed to ligament fraud and phishing (among different things). The institution has yet to merchandise a connection astir nan unprotected data, but hopefully, we’ll perceive thing charismatic soon. When information is near unprotected, it tin beryllium indexed by hunt engines and taken by threat actors who are perpetually scanning nan net for these types of unprotected files.

While those successful nan U.S. don’t request to interest astir their individual accusation being compromised successful this instance, it shows conscionable really important password information is. An easy-to-guess password makes you arsenic susceptible arsenic nary password astatine all. Another 1 of nan worst password mistakes successful nan past decade was Equifax, nan 2017 information breach that, owed to utilizing “admin” arsenic their password, made it easy for hackers to bargain their data.