A few weeks ago, DataBreaches.net reported on a leaky Amazon S3 bucket owned by MedCall Advisors in NC. The leak, which exposed approximately 3,000 patients’ protected health information, was discovered by UpGuard, who published a number of redacted screenshots to document the leak. Their detailed report also noted how Randy Baker, the CEO of MedCall Advisors, did not acknowledge or respond to their notification of the leak, although the leak was secured within hours of them sending the CEO an email. MedCall also failed to respond to questions put to it by DataBreaches.net.
MedCall Advisors not only failed to respond to UpGuard and DataBreaches.net, but, more importantly, perhaps, they never even asked whether they would securely delete any ePHI they may have acquired.
In light of their response—or lack of response—it shouldn’t be a total surprise to learn that a few weeks later, DataBreaches.net was contacted by another researcher, Britton White, who informed this site that MedCall Advisor’s S3 bucket was leaking again.
This time, it appeared that 10,000 files might be available for download and/or deletion or editing. The leak was noted on grayhatwarefare.com’s site, where any curious soul or criminal could find pages and pages of exposed MedCall files listed for the taking.
White attached a .csv file that included patients’ name, email address, postal address, phone numbers (fixed and cell), gender, date of birth, and Social Security Number.
Other files contained recordings of patient evaluations/conversations with doctors, and records completed by doctors following patient or injured employee contacts. These detailed records contained information such as what medications the patient was already on, any allergies, the nature and detail of their complaint, onset, etc.
Even files that appeared to be deleted from the bucket were actually still available for download. And as before, there was no login required, no encryption of the data, and the files were writable. DataBreaches.net promptly emailed MedCall Advisors to alert them to this newest leak. Once again, the email notification resulted in security of the data but without any acknowledgement from the firm
