InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler found and reported a non-password-protected database with over 86,000 records belonging to ESHYFT, a New Jersey-based HealthTech company.
ESHYFT operates in 29 states and provides a mobile app platform connecting healthcare facilities with workers like Certified Nursing Assistants (CNAs), Licensed Practical Nurses (LPNs), and Registered Nurses (RNs). Jeremiah Fowler said, the name of the database as well as the documents inside it indicated that the records belonged to ESHYFT.
NVIDIA Releases Security Update For GPU Driver Vulnerabilities
‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA
159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure
NVIDIA NeMo Framework Vuln Allow Attackers RCE
Cisco Issued Urgent Security Advisories For Multiple Products
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
The exposed database, which was not password-protected or encrypted, contained 86,341 records and was 108.8 GB in size. Most documents were in a folder labeled “App,” including user profile images, monthly work schedules, professional certificates, work agreements, CVs, and other personal identifiable information (PII). One spreadsheet alone had over 800,000 entries detailing nurses’ IDs, facility names, shift times, and hours worked.
After notifying the issue, the authority tanked the researcher saying “Thank you! we’re actively looking into this and working on a solution” and restricted the dataset from public access.
ESHYFT is a mobile app that links healthcare facilities with qualified nurses. It’s available on both the Apple App Store and Google Play Store, with over 50,000 downloads on Google Play.
Jeremiah Fowler suggested Health tech companies and medical software providers should prioritize cybersecurity to safeguard data and prevent unauthorized access. They should implement mandatory encryption for sensitive information and conduct regular security audits to find vulnerabilities. It’s advisable to limit the storage of sensitive data, anonymize records when possible, and set expiration dates for unused information.
