A recent investigation by Cybernews revealed a 500GB unsecured database belonging to a Mexican health care provider discovered on August 26, 2024. This database contains critical personal information, including names, CURP identification numbers, phone numbers, details of payment requests, and more.
The breach affects approximately 5.3 million individuals, which represents around 4% of Mexico’s population, according to Cybernews. The report attributes the lapse in security to a misconfiguration of a data visualization tool known as Kibana, which was reportedly left without authentication.
The significant amount of exposed data has been traced back to Ecaresoft, a software company based in Texas that provides cloud-based Hospital Information Systems like Anytime and Cirrus. Ecaresoft’s services are utilized by more than 30,000 medical professionals, 65 hospitals, and 110 outpatient centers, assisting them with tasks such as appointment scheduling, medication management, inventory control, and various other functions.
In addition to the previously mentioned personal details, the compromised data also includes information on ethnicities, nationalities, religious beliefs, blood types, birth dates, gender identifiers, email addresses, healthcare service charges, and records of hospitals visited. Interestingly, this incident does not appear to be the result of malicious activities by threat actors, and there is no current official information regarding the awareness of the affected users or the duration that the unsecured database was accessible.
While users’ health records were not compromised, the exposure of their Mexican government IDs—akin to Social Security numbers in the U.S.—places them at risk for wire fraud, phishing, and other forms of cybercrime. Ecaresoft has yet to issue a public statement regarding the data breach, though industry observers hope for an official update soon. Unsecured data can be indexed by search engines and potentially targeted by cybercriminals who continually scan the internet for such vulnerabilities.
Although Americans need not worry about their information being compromised in this incident, it serves as a powerful reminder of the necessity for strong password practices. Simple or easily guessable passwords create vulnerabilities that can be just as dangerous as having no password at all. A prominent example of this was the 2017 Equifax data breach, where the use of “admin” as a password made it straightforward for hackers to access sensitive company data.