InfoSecBulletin Cybersecurity for mankind
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured database from the UK software firm Logezy, which specializes in employee data management. Cybersecurity researcher Jeremiah Fowler from vpnMentor discovered this issue.
Fowler’s investigation found nearly 8 million unprotected records, totaling 1.1 TB of data (7,975,438 files) in a database without password protection or encryption.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
The exposed database held sensitive information such as work authorization documents, national insurance numbers, certificates, electronic signatures, timesheets, user images, and government IDs.
“The database also contained 656 directory entries indicating different companies, most of which were healthcare providers, recruiting agencies, or temporary employment services, Fowler noted in his report.
Fowler quickly informed Logezy, and access to the database was restricted.
Logezy, a company based in Derby, England, offers Staff Management Software to simplify managing permanent and temporary staff. Its features include worker deployment, payments, billing, and employee data management. Although Logezy claims to cater to multiple industries, most exposed records were related to the healthcare sector and its workers.
Data exposure presents significant risks, especially in healthcare, which is often targeted by cyberattacks. Stolen information can be misused for identity theft, with criminals posing as healthcare workers for financial gain.
The exposed credentials and electronic signatures could also facilitate unauthorized access to internal healthcare systems, possibly exposing sensitive patient data. “It is no secret that healthcare data is a valuable commodity to cyber criminals, but so is the PII of those who work in the healthcare industry,” said Fowler.
Jeremiah Fowler highlights the risks of centralized data storage, especially for companies managing data from various organizations. He suggests that using separate, secure storage with strong access controls and encryption can better prevent data leaks.
