Skip to main content

LabCorp website bug exposed thousands of medical documents

A security flaw in LabCorp’s website exposed thousands of medical documents, like test results containing sensitive health data.

It’s the second incident in the past year after LabCorp said in June that 7.7 million patients had been affected by a credit card data breach of a third-party payments processor. The breach also hit several other laboratory testing companies, including Quest Diagnostics.

This latest security lapse was caused by a vulnerability on a part of LabCorp’s website, understood to host the company’s internal customer relationship management system. Although the system appeared to be protected with a password, the part of the website designed to pull patient files from the back-end system was left exposed. That unprotected web address was visible to search engines and was later cached by Google, making it accessible to anyone who knew where to look. The cached search result only returned one document — a document containing a patient’s health information. But changing and incrementing the document number in the web address made it possible to access other documents.

The bug is now fixed.

Using computer commands, we determined the approximate number of exposed documents by asking the exposed server if a document existed by returning certain properties about the file — such as its size — but not the document itself. This allowed us to see if a document was on the server without accessing large amounts of patient information, and thus preventing any further exposure to the patient’s privacy.

The results showed at least 10,000 documents were exposed.

Of the handful of files we examined to understand what kind of data was exposed, the documents largely appeared to affect cancer patients under the laboratory’s Integrated Oncology speciality testing unit.

The documents contained names, dates of birth, and in some cases Social Security numbers of patients. The documents also contained lab test results and diagnostic data, a class of data considered protected health information under the Health Insurance Portability and Accountability Act (HIPAA). A couple of the documents we reviewed contained a footer notice, which said: “This document contains private and confidential health information protected under state and federal law.”

Running afoul of HIPAA can result in heavy fines.

“This is a massive privacy issue — and one that could impact affected users and patients for years to come,” said Rachel Tobac, a hacker, social engineer, and founder of SocialProof Security. “The sensitive nature of those documents and the leak of private medical status is a huge privacy violation for those patients for obvious reasons, but also sadly for some possibly less glaring reasons, as well.”

Tobac, who reviewed our findings, said medical information can be “terribly useful” for criminals in identity theft, extortion, and phishing, because the victim may be more likely to trust the sender “under the assumption that the message is legitimate because it contains information only their medical provider could or should know.”

The vulnerability was found in-house at TechCrunch and was reported to LabCorp, which later pulled the server offline. Although the web address remains in Google’s search results, the link is now dead.

“I can confirm that we have terminated access to the system,” said LabCorp spokesperson Donald Von Hogan. But the company would not ay if it planed to inform patients and state authorities under data breach notification laws to the security lapse.

LabCorp’s Von Hogan said in a call that the company would not confirm the documents found on the exposed server “are in fact LabCorp information.”

TechCrunch reached out to a number of patients to verify their information. Only one person confirmed by phone that the information in their exposed file was accurate, but expressed that they did not want to be named for this story.

Two other people whose names were in the files had since passed away, according to obituaries.



from TechCrunch https://ift.tt/31boWKl
via IFTTT

Comments

Popular posts from this blog

The Silent Revolution of On-Device AI: Why the Cloud Is No Longer King

Introduction For years, artificial intelligence has meant one thing: the cloud. Whether you’re asking ChatGPT a question, editing a photo with AI tools, or getting recommendations on Netflix — those decisions happen on distant servers, not your device. But that’s changing. Thanks to major advances in silicon, model compression, and memory architecture, AI is quietly migrating from giant data centres to the palm of your hand. Your phone, your laptop, your smartwatch — all are becoming AI engines in their own right. It’s a shift that redefines not just how AI works, but who controls it, how private it is, and what it can do for you. This article explores the rise of on-device AI — how it works, why it matters, and why the cloud’s days as the centre of the AI universe might be numbered. What Is On-Device AI? On-device AI refers to machine learning models that run locally on your smartphone, tablet, laptop, or edge device — without needing constant access to the cloud. In practi...

Apple’s AI Push: Everything We Know About Apple Intelligence So Far

Apple’s WWDC 2025 confirmed what many suspected: Apple is finally making a serious leap into artificial intelligence. Dubbed “Apple Intelligence,” the suite of AI-powered tools, enhancements, and integrations marks the company’s biggest software evolution in a decade. But unlike competitors racing to plug AI into everything, Apple is taking a slower, more deliberate approach — one rooted in privacy, on-device processing, and ecosystem synergy. If you’re wondering what Apple Intelligence actually is, how it works, and what it means for your iPhone, iPad, or Mac, you’re in the right place. This article breaks it all down.   What Is Apple Intelligence? Let’s get the terminology clear first. Apple Intelligence isn’t a product — it’s a platform. It’s not just a chatbot. It’s a system-wide integration of generative AI, machine learning, and personal context awareness, embedded across Apple’s OS platforms. Think of it as a foundational AI layer stitched into iOS 18, iPadOS 18, and m...

Max Q: Psyche(d)

In this issue: SpaceX launches NASA asteroid mission, news from Relativity Space and more. © 2023 TechCrunch. All rights reserved. For personal use only. from TechCrunch https://ift.tt/h6Kjrde via IFTTT