Missing password leads to 5.3 million leaked health records

Cybernews reports its research teams found a 500GB unprotected database of a Mexican health care company on August 26, 2024. The database exposes sensitive information such as names, personal identification numbers (CURP), phone numbers, descriptions of payment requests, and more.

The total amount of affected people adds up to 5.3 million, making up approximately 4% of the country’s population, as Cybernews notes. The Cybernews report indicates that the security mistake occurred with a “misconfigured” use of a data visualization tool called Kibana, which appears to have been left unauthenticated.

The massive volume of data was later credited to Ecaresoft, a Texas-based software company behind cloud-based Hospital Information Systems such as Anytime and Cirrus. More than 30,000 doctors, 65 hospitals, and 110 outpatient care centers use Ecaresoft services to manage tasks such as appointment booking, medicine management, inventory management, and more.

Other stolen data includes ethnicities, nationalities, religions, blood types, dates of birth, gender, email addresses, the amount charged for health care services, and the hospitals visited. This time around, threat actors are not to blame as the cause. There is no official information about whether the affected users are aware of the situation or how long the database (now taken down) was up and running.

The affected users’ health records were not taken, but with their Mexican government identification…