InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler found and reported a non-password-protected database with over 86,000 records belonging to ESHYFT, a New Jersey-based HealthTech company.
ESHYFT operates in 29 states and provides a mobile app platform connecting healthcare facilities with workers like Certified Nursing Assistants (CNAs), Licensed Practical Nurses (LPNs), and Registered Nurses (RNs). Jeremiah Fowler said, the name of the database as well as the documents inside it indicated that the records belonged to ESHYFT.
Researcher found non protected database form ESHYFT containig 86000 records
CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws
CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws
CVE-2025-20138
Cisco released High Security Alert for IOS XR Software
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
The exposed database, which was not password-protected or encrypted, contained 86,341 records and was 108.8 GB in size. Most documents were in a folder labeled “App,” including user profile images, monthly work schedules, professional certificates, work agreements, CVs, and other personal identifiable information (PII). One spreadsheet alone had over 800,000 entries detailing nurses’ IDs, facility names, shift times, and hours worked.
After notifying the issue, the authority tanked the researcher saying “Thank you! we’re actively looking into this and working on a solution” and restricted the dataset from public access.
ESHYFT is a mobile app that links healthcare facilities with qualified nurses. It’s available on both the Apple App Store and Google Play Store, with over 50,000 downloads on Google Play.
Jeremiah Fowler suggested Health tech companies and medical software providers should prioritize cybersecurity to safeguard data and prevent unauthorized access. They should implement mandatory encryption for sensitive information and conduct regular security audits to find vulnerabilities. It’s advisable to limit the storage of sensitive data, anonymize records when possible, and set expiration dates for unused information.
