InfoSecBulletin Cybersecurity for mankind
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured database from the UK software firm Logezy, which specializes in employee data management. Cybersecurity researcher Jeremiah Fowler from vpnMentor discovered this issue.
Fowler’s investigation found nearly 8 million unprotected records, totaling 1.1 TB of data (7,975,438 files) in a database without password protection or encryption.
UK Software Firm Exposed 8 million of Healthcare Worker Records
GitHub Enterprise Server Vulns Expose Risk of Code Execution
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
The exposed database held sensitive information such as work authorization documents, national insurance numbers, certificates, electronic signatures, timesheets, user images, and government IDs.
“The database also contained 656 directory entries indicating different companies, most of which were healthcare providers, recruiting agencies, or temporary employment services, Fowler noted in his report.
Fowler quickly informed Logezy, and access to the database was restricted.
Logezy, a company based in Derby, England, offers Staff Management Software to simplify managing permanent and temporary staff. Its features include worker deployment, payments, billing, and employee data management. Although Logezy claims to cater to multiple industries, most exposed records were related to the healthcare sector and its workers.
Data exposure presents significant risks, especially in healthcare, which is often targeted by cyberattacks. Stolen information can be misused for identity theft, with criminals posing as healthcare workers for financial gain.
The exposed credentials and electronic signatures could also facilitate unauthorized access to internal healthcare systems, possibly exposing sensitive patient data. “It is no secret that healthcare data is a valuable commodity to cyber criminals, but so is the PII of those who work in the healthcare industry,” said Fowler.
Jeremiah Fowler highlights the risks of centralized data storage, especially for companies managing data from various organizations. He suggests that using separate, secure storage with strong access controls and encryption can better prevent data leaks.
