OCR has announced another settlement. This one involves Sentara Hospitals, and it’s a somewhat surprising one in the sense that Sentara not only seems to have gotten the fundamentals of HIPAA and notification compliance wrong, but then they seem to have insisted in their wrongheaded ways even after HHS told them what their obligations were. …
Category: Exposure
Security lapse exposes personal data of 6,500 Singapore accountants
Eileen Yu reports: A folder containing personal data of 6,541 accountants in Singapore was “inadvertently” sent to multiple parties, in a security lapse that was uncovered only months after when a review was conducted. The incident exposed personal details such as names, national identification number, date of birth, and employment information. The incident occurred under…
French Hotel Giant Leaks 1TB+ of Client Data
Phil Muncaster reports: A leading European hotel booking platform has leaked over 1TB of data on customers, clients and partners thanks to an unsecured Elasticsearch database, exposing them to account takeover, identity theft and financial fraud. The database reportedly belongs to French B2B hotel booking firm Gekko Group, a subsidiary of Europe’s largest hotel group,…
Personal And Social Information Of 1.2 Billion People Discovered In Massive Data Leak, But Who’s Responsible??
Over on DataViper.io, Vinny Troia reports that he and Bob Diachenko found a massive data leak that appears to implicate two data enrichment firms: People Data Labs (PDL), and OxyData.io. But “implicate” is not the same thing as being able to actually attribute ownership of the elasticsearch server that was open at 35.199.58.125, and both…
Veterans Affairs put millions of people at risk of identify theft, audit finds
Eric Yoder reports: The Veterans Affairs Department, while responding to requests for records on veterans’ benefits claims, “put millions of people at risk of identity theft” by not deleting personally identifying information on other people from those records, an audit has found. That information included names and Social Security numbers of people such as other…
WeWork Developers Exposed Contracts and Customer Data on GitHub
Joseph Cox reports: WeWork developers exposed customer contracts, some of which contained bank account details, and the personal and contact information of other potential customers to the open internet. The issue impacts a subset of WeWork customers based in India, China, and Europe. The news comes after WeWork has essentially imploded, with its valuation tumbling and…