- Researchers found unsecured online database with nearly eight million files
- Database contained Documentation of Work Permit, National Insurance Numbers, Certificates and Other Sensitive Data
- It belonged to the software company Logezy that says the database is locked now
Millions of health workers in the UK have had their sensitive data leaked online after a non-passord-protected database was found unsecured on the Internet.
Security researcher Jeremiah Fowler found a database 1.1TB in size containing nearly eight million files (7,975,438), including images and .pdf files, work permit documents, national insurance numbers, certificates, electronic signatures, Times, user images and state-issued identification documents.
In addition, the archive contained 656 catalog items indicating various companies, most of which were healthcare providers, recruitment agencies and temporary employment services.
Identity theft and other risks
Fowler determined the database belonged to Logezy, an employee management and tracking software company based in the UK.
He informed Logezy of his findings and the company locked the database “Shortly after”.
To hunt for unprotected databases, researchers would use a specialized search engine, such as Shodan, and analyze the results.
So far, Fowler has found dozens of similar cases, including clickbalance (more than 750 million records), DM Clinical Research (over one million clinical items) or service bridge (31 million).
Without a detailed forensic analysis, it is impossible to know if a threat actor who already has access to the database and exfiltered the information found there.
It is also impossible to know how long the archive remained unlocked, and if Logezy managed it, or a third party on its behalf.
These cases are considered a low hanging fruit for cyber criminals. Stealing this information does not require phishing, social engineering, hunting of zero-day vulnerabilities or utilization of uncontrolled end points.
Nevertheless, the data inside is valuable as they are usually up to date and can be used in all sorts of fraud, including thread fraud, payment fraud, identity theft and more.
If you have used Logezy in the past would be wise to keep an eye on your accounts and credit reports for potentially suspicious activity.
