InfoSecBulletin Cybersecurity for mankind
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured database from the UK software firm Logezy, which specializes in employee data management. Cybersecurity researcher Jeremiah Fowler from vpnMentor discovered this issue.
Fowler’s investigation found nearly 8 million unprotected records, totaling 1.1 TB of data (7,975,438 files) in a database without password protection or encryption.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
The exposed database held sensitive information such as work authorization documents, national insurance numbers, certificates, electronic signatures, timesheets, user images, and government IDs.
“The database also contained 656 directory entries indicating different companies, most of which were healthcare providers, recruiting agencies, or temporary employment services, Fowler noted in his report.
Fowler quickly informed Logezy, and access to the database was restricted.
Logezy, a company based in Derby, England, offers Staff Management Software to simplify managing permanent and temporary staff. Its features include worker deployment, payments, billing, and employee data management. Although Logezy claims to cater to multiple industries, most exposed records were related to the healthcare sector and its workers.
Data exposure presents significant risks, especially in healthcare, which is often targeted by cyberattacks. Stolen information can be misused for identity theft, with criminals posing as healthcare workers for financial gain.
The exposed credentials and electronic signatures could also facilitate unauthorized access to internal healthcare systems, possibly exposing sensitive patient data. “It is no secret that healthcare data is a valuable commodity to cyber criminals, but so is the PII of those who work in the healthcare industry,” said Fowler.
Jeremiah Fowler highlights the risks of centralized data storage, especially for companies managing data from various organizations. He suggests that using separate, secure storage with strong access controls and encryption can better prevent data leaks.
