Cloud Security,
Data Breach Notification,
Data Security
Security Researcher Discovers Unsecured Database Exposing 1,864 GB of OrthoMinds Data
A cloud-based orthodontic practice management vendor, OrthoMinds, is in the process of notifying patients regarding a data exposure incident that lasted for ten days in November 2024. However, a security researcher who uncovered the unsecured database claims that the breach may have persisted for a longer period and potentially impacted over 200,000 patients.
OrthoMinds, headquartered in Georgia, publicly addressed the breach, stating they are informing affected clients and individuals about the security incident. The company relayed that they became aware of a potential issue within their network environment in November 2024 and subsequently initiated an investigation to assess and remediate the situation. The investigation revealed that certain database files had possibly been accessible to individuals outside the organization between November 17 and 27, 2024.
The compromised data includes sensitive information such as names, birth dates, medical records, health insurance details, financial card information, and Social Security numbers. The security researcher, who goes by JayeLTee, indicated that the server housing the sensitive data had been unsecured since at least October 2024. JayeLTee detailed that he stumbled upon the database in his logs amidst numerous servers, noting its lack of access controls which allowed unauthorized file listing and downloads.
In January, JayeLTee published a report detailing his findings, indicating the exposure of approximately 1,864 gigabytes of data, which amounts to over 300 database backups from OrthoMinds’ dental clinic clients, covering a timeline from November 2020 to mid-October 2024. He emphasized that while 300 files were exposed, some clients had multiple backups indicating the number of impacted individuals could be significantly higher, estimating a minimum of 200,000 patients affected based on his analysis of just one backup.
In its initial report to federal regulators on January 24, OrthoMinds categorized the event as a “hacking/IT incident” affecting 501 individuals, although that figure appears to be a preliminary estimate given the scale of the breach. As of now, OrthoMinds has not provided clarity on the total number of clients or individuals affected, nor have they confirmed whether they will be updating their breach report with the U.S. Department of Health and Human Services.
OrthoMinds assured that there is currently no evidence indicating that the compromised data has been misused. The company is offering free credit monitoring services to those whose Social Security numbers or payment card information may have been exposed and has pledged to enhance its existing data security measures to prevent similar incidents in the future.
Broader Context of Data Exposures
Incidents of data exposures due to IT misconfigurations remain a pressing issue across healthcare and various sectors. Security researcher JayeLTee highlighted that the root of such problems often lies in inadequate access controls implemented by organizations, allowing for the unintended exposure of valuable information. Other researchers, such as Jeremiah Fowler, have also reported concerning trends involving unsecured health data being made publicly accessible on the internet, exacerbating vulnerabilities in an already rife landscape of cyber threats.
Federal regulators are increasingly scrutinizing these incidents, and punitive actions have been taken in notable cases involving breaches due to misconfiguration, emphasizing the necessity for businesses to prioritize robust cybersecurity practices. As underscored in the MITRE ATT&CK framework, tactics such as initial access through unsecured databases, potential privilege escalation, and persistence methods must be effectively managed by organizations to safeguard against significant data breaches.
