Massive Data Breach in Mexican Health Care Sector Exposes 5.3 Million Users’ Data

In a significant data breach, Cybernews researchers discovered a 500GB unprotected database from a Mexican health care company on August 26, 2024, exposing sensitive details of approximately 5.3 million people. Information in the leak included names, CURP identification numbers, phone numbers, email addresses, and details of payment requests. This security lapse occurred due to a misconfigured Kibana visualization tool, which left the database publicly accessible. While health records were reportedly not taken, the exposed CURPs (Mexican ID numbers akin to Social Security numbers) create risks for identity theft and phishing attacks. 

The breach has been attributed to Ecaresoft, a Texas-based firm specializing in cloud-based Hospital Information Systems, which provides services like Anytime and Cirrus. Over 30,000 doctors and 65 hospitals rely on Ecaresoft’s solutions for scheduling, inventory management, and patient data handling. However, a lapse in securing this information has now exposed users to heightened cybersecurity risks.

Besides personal details, the exposed database included patients’ ethnicities, nationalities, religions, blood types, dates of birth, and gender, along with specifics about medical visits and fees. Although hackers were not directly responsible for this breach, the open database left users’ data vulnerable to any threat actors actively scanning for unsecured files online. 

Ecaresoft has yet to release a statement addressing the issue. As the database has sinc

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.