InfoSecBulletin Cybersecurity for mankind
Archer Health, a US provider of in-home and palliative care, left an unsecured database online, exposing sensitive personal and health information to anyone who could find it, experts say. Cybersecurity researcher Jeremiah Fowler alerted WebsitePlanet after discovering the database and assisting in securing it.
Fowler discovered an unprotected database with about 145,000 files, including PDFs and PNGs. It contained documents like assessments, home health certifications, care plans, and discharge forms.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Locking the database down:
These files, totaling 23GB, included names, patient IDs, SSNs, addresses, phone numbers, and other personal information. They also contained diagnoses and treatment details.
Archer Health, or Archer Home Health, offers in-home medical services including skilled nursing, therapy, nutritional guidance, social work, home health aides, and wound care.
They offer palliative care that emphasizes symptom relief, managing the disease, comfort, and support for those with serious or chronic illnesses.
After Fowler contacted them, the company secured the database and thanked him for the alert.
“Thank you for bringing this to our attention,” Archer Health told Fowler. “We take data security and patient privacy very seriously. Our team is actively investigating this matter and will address any security issues promptly.”
Unless a forensic analysis is conducted, we cannot determine if the database was accessed prior to Fowler finding it. There is no proof that the database was leaked on the dark web. Additionally, we are unsure how long the archive was open or who operated it, whether it was Archer Health or someone else.
