Cyber Incident Victim: Innovative Solution for Healthcare
Date:
Oct 2020
Location:
Viet Nam
Summary
A healthcare technology company exposed 12 million sensitive medical records, including detailed diagnoses, through an unsecured Elasticsearch server discovered during a routine scan. Researchers identified the unprotected cloud repository, which was subsequently compromised by the automated "Meow" attack that irreversibly deleted data without ransom demands. The incident exposed highly confidential patient information for an unspecified duration prior to detection, though the server's vulnerability timeline remained unclear. This breach combined critical data exposure with destructive system intrusion, impacting both privacy and data integrity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In late October 2020, researchers from SafetyDetectives led by Anurag Sen discovered an unprotected Elasticsearch server belonging to an unnamed healthcare technology company during a routine IP address scan. The exposed cloud server contained approximately 12 million medical records that included highly sensitive patient diagnostic information. While the exact duration of exposure prior to discovery remains unknown, the server was accessible without authentication, allowing potential unauthorized access to the trove of protected health data. The incident gained notoriety when the vulnerable infrastructure was subsequently compromised by the automated "Meow" attack, which overwrites exposed databases with no clear motive beyond destruction. SafetyDetectives publicly disclosed the breach on December 23, 2020, through a report by Phil Muncaster published on DataBreaches.net, though the original discovery occurred nearly two months earlier during their security research activities.
The Meow attack's intervention destroyed portions of the exposed medical records, though the extent of data destruction versus prior unauthorized access remains unclear from available reporting. No threat actor claimed responsibility for either the initial exposure or the subsequent Meow compromise. The incident exposed sensitive patient health information at significant scale, with 12 million records compromised across an unspecified number of healthcare providers or individuals. Public reporting did not confirm whether the healthcare technology company notified affected parties or regulatory bodies about the breach. SafetyDetectives' discovery methodology involved scanning internet-facing systems for misconfigured Elasticsearch instances, a common vector for inadvertent data exposure. The researchers did not specify whether they identified the healthcare technology company by name or merely documented the technical parameters of the exposed infrastructure.