Dr Lal PathLabs, one of the largest lab testing companies in India, left a huge cache of patient data on a public server for months, TechCrunch has learned. The lab testing giant, headquartered in New Delhi, serves some 70,000 patients a day, and quickly became a major player in testing patients for COVID-19 after winning approval from the Indian government. But the company was storing hundreds of large spreadsheets packed with sensitive patient data in a storage bucket, hosted on Amazon Web Services (AWS), without a password, allowing anyone to access the data inside.
Experts Comments
October 12, 2020
Another week, another AWS misconfigured server. It is clear that those that choose to use cloud-based databases must perform necessary due diligence to configure and secure every corner of the system properly. Sadly, with the recent wave of AWS, ElasticSearch, MongoDB, Big Data, and other Open Source breaches, it does look like security is not being taken seriously enough.
Healthcare institutions are seen as softer targets as not only are these systems just as rich with data as the traditional .....Read More
Like(
October 12, 2020
To collect such sensitive data without having the basic security controls in place breaches PII regulatory and Healthcare compliance requirements, never mind industry best practices. Dr Lal PathLabs were fortunate to have received warning from a benevolent security expert but we do not know how long the information has been exposed and what other actors may have gained access. The company has a responsibility to swiftly reach out to patients and inform them of these circumstances, including.....Read More
October 12, 2020
Breaches often happen when organisations are overwhelmed just as in this case. That's why it's critical to have secure processes and policies in place so that security is built into every day operations. Not using password protection, allowing everyone full access to sensitive data- this is breaking the fundamental rules of cyber hygiene. Employees should be educated on basic cyber security as well as the impacts that a breach can have on their organisation and the people they serve to avoid.....Read More
October 12, 2020
Wow! Another day, another unprotected bucket of data. It's hard to fathom that a firm would leave unprotected data available on the web, especially in today's atmosphere of heightened security. But, it has happened again. While kudos are deserved for the company quickly securing the data once a security researcher tipped them off, the data should never have been left in an unsecured form.
Hopefully Dr Lal PathLabs' "investigation" will result in the responsible parties being disciplined, which .....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Sergio Lourerio, Cloud Security Director , provides expert commentary at @Information Security Buzz.
"companies using AWS for analytics or big data projects and making careless mistakes in the misconfiguration..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-millions-of-records-belonging-to-medical-testing-firm-found-exposed-online
Facebook Message
@Sergio Lourerio, Cloud Security Director , provides expert commentary at @Information Security Buzz.
"companies using AWS for analytics or big data projects and making careless mistakes in the misconfiguration..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/experts-on-millions-of-records-belonging-to-medical-testing-firm-found-exposed-online