The Spilt AWS Bucket That Flushes Medical Records Down the Toilet
- Javier Conejo del Cerro
- 14 mar
- 3 Min. de lectura
A critical misconfiguration in an Amazon Web Services (AWS) S3 bucket belonging to ESHYFT, a New Jersey-based HealthTech company, has exposed the personal and professional records of over 86,000 healthcare workers. The 108.8 GB unprotected database, discovered by cybersecurity researcher Jeremiah Fowler, left sensitive information—including personally identifiable information (PII), financial data, and medical documents—accessible to anyone online. While the exposure does not appear to be the result of a cyberattack, its implications are just as severe, placing thousands of healthcare professionals at risk.
Healthcare Workforce at Risk
The leak affects nurses and healthcare staff working across 29 U.S. states, who rely on ESHYFT to connect with medical facilities. The database contained highly sensitive documents, including:
Resumes and CVs – Detailing employment history, skills, and credentials.
Professional certificates and licenses – Verifying eligibility to practice.
Work schedules and salary details – Providing insight into financial information.
Profile images – Some including medical ID badges, further compounding privacy concerns.
Medical leave documents – Potentially containing diagnoses and treatments, raising HIPAA compliance issues.
The exposure of this data could lead to identity theft, targeted phishing campaigns, financial fraud, and even cyber extortion. With no encryption or password protection, any malicious actor could have accessed and exploited this information without needing to bypass any security measures.
Leeway for Cybercriminals
The AWS misconfiguration meant that the database was fully exposed to the internet, making it easily accessible to anyone who stumbled upon it.
Who is responsible? It remains unclear whether ESHYFT itself or a third-party contractor was responsible for managing the database.
How long was the data exposed? There is no official confirmation regarding the duration of exposure, which adds another layer of uncertainty.
How was the breach discovered? Researcher Jeremiah Fowler found the publicly accessible database and promptly notified ESHYFT, which acknowledged the issue and began remediation efforts.
Given the high-value nature of medical industry data, it is highly possible that bad actors may have already accessed and copied this information before the vulnerability was patched.
Patching the Security Gap
For HealthTech companies handling sensitive personnel and medical data, security cannot be an afterthought. A proactive cybersecurity strategy is necessary to prevent similar breaches. To safeguard sensitive data, organizations must:
Encrypt All Stored Data: Ensure that all databases containing PII, financial records, and medical documents are properly encrypted, preventing unauthorized access.
Enforce Strict Access Controls: Use role-based access control (RBAC) to limit who can access sensitive data, preventing unnecessary exposure.
Implement Multi-Factor Authentication (MFA): Require MFA for all accounts handling sensitive information, adding an extra layer of security.
Regularly Audit Security Configurations: Conduct frequent cloud security audits to identify and rectify misconfigurations before they lead to data breaches.
Limit Data Retention: Only store essential information and implement policies for automatic deletion of outdated or unnecessary records.
Monitor AWS S3 Buckets Continuously: Deploy real-time monitoring tools to detect unauthorized access attempts or unexpected exposure of sensitive data.
Establish a Data Breach Response Plan: Have a well-documented incident response protocol to act quickly and notify affected individuals in case of a breach.
The ESHYFT AWS misconfiguration is yet another reminder that cloud misconfigurations remain one of the leading causes of data breaches. The fact that no hacking or malware was needed to access this trove of sensitive data highlights the importance of strong cybersecurity hygiene. With identity theft, financial fraud, and compliance violations at stake, HealthTech firms must prioritize securing their cloud infrastructure to protect both healthcare workers and their institutions.
With more healthcare services shifting online, ensuring proper access controls, encryption, and proactive monitoring is crucial in fortifying sensitive data against breaches and unauthorized exposure.
Comments