a surety flaw in LabCorps website exposed thousands of medical documents, like test results containing sensitive health data.
Its the arcsecond incident in the past twelvemonth after LabCorp said in June that 7.7 jillion patients had been affected by a credit card data breach of a third-party payments processor. That breach also bang several other laboratory testing companies, including quest Diagnostics.
This latest certificate lapse was caused by a vulnerability on a part of LabCorps website, understood to host the companys internal customer relationship management system. Although the system appeared to be protected with a password, the part of the website designed to clout patient files from the back-end system was left exposed. That unprotected web call was visible to search engines and was later cached by Google, qualification it accessible to anyone who knew where to look. The cached lookup resultant only returned i document a document containing a patients health information. But changing and incrementing the document number in the web call made it possible to access other documents.
The bug is now fixed.
Using computer commands, we determined the approximate number of exposed documents by asking the exposed server if a document existed by returning certain properties about the file such as its size but not the document itself. This allowed us to see if a document was on the server without accessing large amounts of patient information, and thus preventing any further exposure to the patients privacy.
The results showed at least 10,000 documents were exposed.
Of the fistful of files we examined to see what kind of data was exposed, the documents largely appeared to impress cancer patients under the laboratorys Integrated Oncology specialty testing unit.
The documents contained names, dates of birth and, in some cases, social Security numbers of patients. The documents also contained lab prove results and diagnostic data, a class of data considered protected health info under the Health Insurance Portability and accountability bit (HIPAA). A couple of the documents we reviewed contained a footer notice, which said: This document contains private and confidential health information protected under land and federal law.
Running afoul of HIPAA can result in heavy fines.
This is a massive privacy publication and i that could impact affected users and patients for years to come, said Rachel Tobac, a hacker, social engineer and founder of SocialProof Security. The sensitive nature of those documents and the leak of private medical status is a huge privacy violation for those patients for obvious reasons, but also sadly for some possibly less glaring reasons, as well.
Tobac, who reviewed our findings, said medical info can be terribly useful for criminals in identity theft, extortion and phishing, because the victim may be more likely to trust the sender under the assumption that the message is legitimate because it contains information only their medical provider could or should know.
The vulnerability was found in-house at TechCrunch and was reported to LabCorp, which later pulled the server offline. Although the web speech remains in Googles search results, the link is now dead.
I can support that we hold terminated access to the system, said LabCorp representative Donald Von Hogan.
LabCorps Von Hogan said in a call that the companion would not support the documents found on the exposed server are in fact LabCorp information.
TechCrunch reached out to a number of patients to verify their information. Only ace person confirmed by phone that the information in their exposed file was accurate, but expressed that they did not need to be named for this story.
Two other people whose names were in the files had since passed away, according to obituaries.
In a statement emailed after publication, LabCorp said it would notify affected patients as may be appropriate, but would not say if it would inform say and federal authorities under data transgress notification laws.
