InfoSecBulletin Cybersecurity for mankind
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured database from the UK software firm Logezy, which specializes in employee data management. Cybersecurity researcher Jeremiah Fowler from vpnMentor discovered this issue.
Fowler’s investigation found nearly 8 million unprotected records, totaling 1.1 TB of data (7,975,438 files) in a database without password protection or encryption.
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
The exposed database held sensitive information such as work authorization documents, national insurance numbers, certificates, electronic signatures, timesheets, user images, and government IDs.
“The database also contained 656 directory entries indicating different companies, most of which were healthcare providers, recruiting agencies, or temporary employment services, Fowler noted in his report.
Fowler quickly informed Logezy, and access to the database was restricted.
Logezy, a company based in Derby, England, offers Staff Management Software to simplify managing permanent and temporary staff. Its features include worker deployment, payments, billing, and employee data management. Although Logezy claims to cater to multiple industries, most exposed records were related to the healthcare sector and its workers.
Data exposure presents significant risks, especially in healthcare, which is often targeted by cyberattacks. Stolen information can be misused for identity theft, with criminals posing as healthcare workers for financial gain.
The exposed credentials and electronic signatures could also facilitate unauthorized access to internal healthcare systems, possibly exposing sensitive patient data. “It is no secret that healthcare data is a valuable commodity to cyber criminals, but so is the PII of those who work in the healthcare industry,” said Fowler.
Jeremiah Fowler highlights the risks of centralized data storage, especially for companies managing data from various organizations. He suggests that using separate, secure storage with strong access controls and encryption can better prevent data leaks.
