INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

UK Medical Data Leaked by Commercial Market Research Firm

| 2026-10-13 13:00 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data leak was discovered on August 17, 2026, affecting almost 100,000 individuals including patients and medical professionals in the UK. The leaked health data belonged to Liberating Research, a UK-based company that pays patients and medical professionals for answering questions related to their conditions and specialties. The server containing the data was misconfigured to allow public access, exposing sensitive information such as diagnoses and underlying health conditions. This type of attack is known as an Elasticsearch server exposure, where publicly accessible servers are exploited by attackers to gain unauthorized access to sensitive data. As a result of this leak, individuals may face risks including spearphishing, targeted extortion, employment and insurance discrimination, social stigma, and loss of personal dignity.
Technical Mitigations AI-generated
• Patch Elasticsearch server to prevent public access and misconfiguration. • Monitor for rotating log files and meta data in the "lr_user" index, as they may contain PHI or PII. • Implement a secure notification protocol with Liberating Research regarding the data leak.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎August 17th, 2026
The UK-based medical survey company Liberating Research's Elasticsearch server was misconfigured to allow public access, exposing a dataset containing personally identifiable information and medical diagnoses for approximately 100,000 individuals.
industry Health
General Document Context
general_metric 100,000 people
It begins: A data exposure affecting just over 100,000 individuals including patients, medical professionals and charitable organizations was discovered on August 17th, 2026 by UpGuard researchers.
organisation UpGuard
It begins: A data exposure affecting just over 100,000 individuals including patients, medical professionals and charitable organizations was discovered on August 17th, 2026 by UpGuard researchers.
organisation Elasticsearch
The exposure stemmed from an Elasticsearch server misconfigured to allow public access to the data.
organisation PII
However, any dataset combining PII and medical diagnoses creates the same risk, and when that dataset is exposed, the individuals described within face the same consequences.
organisation The Data Analysis
The Data Analysis section of the report begins: The exposed Elasticsearch server contained several indices, mostly rotating log files and meta data.
organisation PHI
One index titled “lr_user” contained 662,365 objects with the PII of 109,700 unique individuals; PHI, including diagnoses and medication details, were present for 73,944 of them.
organisation HIPAA
DataBreaches notes that although the report mentions “PHI,” “protected health information” is a term under the U.S. federal law, HIPAA.
organisation GDPR
The GDPR, which does apply, does not talk about “protected health information.
‎August 31
Threat actors leaked sensitive medical information on almost 100,000 people through a data breach discovered by UpGuard.
tactic Data Leak
On August 31, Greg Pollock from UpGuard contacted DataBreaches.net to report a data leak they discovered containing sensitive medical information on almost 100,000 people.
general_metric 100,000 people
On August 31, Greg Pollock from UpGuard contacted DataBreaches.net to report a data leak they discovered containing sensitive medical information on almost 100,000 people.
‎October 2, 2026
The commercial market research and data-gathering firm in the medical space leaked health data after being notified by UpGuard on October 2, 2026.
industry Health
General Document Context
organisation Personal Data
The security section of their privacy notice (which was updated on October 2, 2026 ( after they were notified by UpGuard) reads: Security We have implemented physical and technical safeguards to protect your Personal Data from loss, misuse, and unauthorised access, disclosure, alternation, or destruction.
‎October 8
DataBreaches contacted Liberating Research via their website contact form on October 8.
organisation DataBreaches
By October 8, he still had not received any reply on whether they would notify anyone or had notified anyone, so DataBreaches contacted Liberating Research via their website contact form.
organisation Liberating Research
By October 8, he still had not received any reply on whether they would notify anyone or had notified anyone, so DataBreaches contacted Liberating Research via their website contact form.
‎2026/10/12
UpGuard published a report yesterday revealing that a commercial market research and data-gathering firm in the medical space leaked health data.
‎2026/10/13
The Information Commissioner's Office was not notified by the leaked health data firm.
organisation the Information Commissioner’s Office
We asked two questions: whether they had notified anyone, and whether they had notified the Information Commissioner’s Office.
Intelligence Sources
Data Breaches 2026-10-13