Medical Practice Exposes Patient Details via Data Breach Incident

A medical practice in Huntington, New York exposed the personal details of 40,000 patients after a digital data repository containing records from Cohen Bergman Klepper Romano Mds PC was left publicly accessible. The incident occurred on January 25th, 2018, when an exposed port within IT systems was discovered by UpGuard Director of Cyber Risk Research Chris Vickery. This exposed port allowed anyone to access the information knowing only the server's IP address, revealing sensitive data including patient names, Social Security numbers, dates of birth, phone numbers, insurance information, and more. The attack works by exploiting a misconfigured rsync utility that was not properly secured against public access. As soon as UpGuard notified Accenture about this publicly exposed information, immediate action was taken to secure the open buckets and prevent further access.