MedCall Advisors suffers second data leak in less than one month

Oct. 11, 2018

A few weeks ago, DataBreaches.net reported on a leaky Amazon S3 bucket owned by MedCall Advisors in NC. The leak, which exposed approximately 3,000 patients’ protected health information, was discovered by UpGuard, who published a number of redacted screenshots to document the leak. Their detailed report also noted how Randy Baker, the CEO of MedCall Advisors, did not acknowledge or respond to their notification of the leak, although the leak was secured within hours of them sending the CEO an email. MedCall also failed to respond to questions put to it by DataBreaches.net.

MedCall Advisors not only failed to respond to UpGuard and DataBreaches.net, but, more importantly, perhaps, they never even asked whether they would securely delete any ePHI they may have acquired.

In light of their response—or lack of response—it shouldn’t be a total surprise to learn that a few weeks later, DataBreaches.net was contacted by another researcher, Britton White, who informed this site that MedCall Advisor’s S3 bucket was leaking again.

This time, it appeared that 10,000 files might be available for download and/or deletion or editing. The leak was noted on grayhatwarefare.com’s site, where any curious soul or criminal could find pages and pages of exposed MedCall files listed for the taking.

White attached a .csv file that included patients’ name, email address, postal address, phone numbers (fixed and cell), gender, date of birth, and Social Security Number.

Other files contained recordings of patient evaluations/conversations with doctors, and records completed by doctors following patient or injured employee contacts. These detailed records contained information such as what medications the patient was already on, any allergies, the nature and detail of their complaint, onset, etc.

Even files that appeared to be deleted from the bucket were actually still available for download. And as before, there was no login required, no encryption of the data, and the files were writable. DataBreaches.net promptly emailed MedCall Advisors to alert them to this newest leak. Once again, the email notification resulted in security of the data but without any acknowledgement from the firm

DataBreaches.net has the full story

Sponsored Recommendations

A Cyber Shield for Healthcare: Exploring HHS's $1.3 Billion Security Initiative

Unlock the Future of Healthcare Cybersecurity with Erik Decker, Co-Chair of the HHS 405(d) workgroup! Don't miss this opportunity to gain invaluable knowledge from a seasoned ...

Enhancing Remote Radiology: How Zero Trust Access Revolutionizes Healthcare Connectivity

This content details how a cloud-enabled zero trust architecture ensures high performance, compliance, and scalability, overcoming the limitations of traditional VPN solutions...

Spotlight on Artificial Intelligence

Unlock the potential of AI in our latest series. Discover how AI is revolutionizing clinical decision support, improving workflow efficiency, and transforming medical documentation...

Beyond the VPN: Zero Trust Access for a Healthcare Hybrid Work Environment

This whitepaper explores how a cloud-enabled zero trust architecture ensures secure, least privileged access to applications, meeting regulatory requirements and enhancing user...