InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler found and reported a non-password-protected database with over 86,000 records belonging to ESHYFT, a New Jersey-based HealthTech company.
ESHYFT operates in 29 states and provides a mobile app platform connecting healthcare facilities with workers like Certified Nursing Assistants (CNAs), Licensed Practical Nurses (LPNs), and Registered Nurses (RNs). Jeremiah Fowler said, the name of the database as well as the documents inside it indicated that the records belonged to ESHYFT.
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
Bengaluru firm got ransomware attack, Hacker demanded $70,000
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today
PwC exits more than a dozen countries in push to avoid scandals: FT reports
Australian Cyber Security Centre Alert for Fortinet Products
Top 10 Malware Threats of the Week: Reports ANY.RUN
The exposed database, which was not password-protected or encrypted, contained 86,341 records and was 108.8 GB in size. Most documents were in a folder labeled “App,” including user profile images, monthly work schedules, professional certificates, work agreements, CVs, and other personal identifiable information (PII). One spreadsheet alone had over 800,000 entries detailing nurses’ IDs, facility names, shift times, and hours worked.
After notifying the issue, the authority tanked the researcher saying “Thank you! we’re actively looking into this and working on a solution” and restricted the dataset from public access.
ESHYFT is a mobile app that links healthcare facilities with qualified nurses. It’s available on both the Apple App Store and Google Play Store, with over 50,000 downloads on Google Play.
Jeremiah Fowler suggested Health tech companies and medical software providers should prioritize cybersecurity to safeguard data and prevent unauthorized access. They should implement mandatory encryption for sensitive information and conduct regular security audits to find vulnerabilities. It’s advisable to limit the storage of sensitive data, anonymize records when possible, and set expiration dates for unused information.
