10 ms·
Covid Test Data Breach: 1.3M Patient Records Exposed Online
- toyg 3y ago[flagged]
- pelagicAustral 3y agoSeems to be working fine. Here's an Archive link: https://web.archive.org/web/20240130154419/https://www.vpnmentor.com/news/report-coronalab-breach/ https://web.archive.org/web/20240130154419/https://www.vpnme...
- toyg 3y agoThanks. Corporate firewalls see "vpn" and go crazy...
- tlivolsi 3y ago[flagged]
- brovid19 3y ago[dead]
- zanfr 3y ago[flagged]
- vdaea 3y ago[flagged]
- systems_glitch 3y agoProbably getting downvoted because somehow this is still a politicized issue :/
- uoaei 3y agoThere is a certain strain of discourse that goes "what? me politics?", getting upset when their obviously politically charged just-asking-questions narrative is called out as such. Concerning at best, antisocial at worst.
- worksonmine 3y agoEverything is politics to someone. Him asking "Why are you downvoted" got flagged, how crazy is that? Getting personal info leaked because one was coerced into taking a test is a completely valid discussion, without getting offended. This is the final days of civilization we're seeing, the idiocracy is here and there's no turning back.
- systems_glitch 3y agoYeah I don't know how we're supposed to have good faith conversations about nontrivial issues if we as a society can't accept that sometimes valid arguments about an issue run counter to personal politics.
- sjsdaiuasgdia 3y agoWhy are you drawing an equivalence between a test for a contagious disease and a genetic analysis service like 23andme? That seems a bit extreme.
- systems_glitch 3y agoWhy does it need to be logged and stored by a third party? I'd not have a problem with an employer offering daily on-site testing with no persistent logging for people who have to be on-site but for whatever reason can't be vaccinated, or if they're having outbreak problems in the area. If no one stored it, there would be nothing to get leaked when the eventuality of data breach happens. Storing it is not in the best interest of the person taking the test, is it? Doubly so for negative or inconclusive results.
- ghaff 3y agoMedical records are typically stored electronically so that, for example, doctors can refer back to your medical history (as can you). I'm not sure why COVID results would be unique in not being stored--and, in fact, seem like something that would be less sensitive than a lot of stored data.
- egberts1 3y agoProblem is use of the word like "Typically ...". Start there.
- systems_glitch 3y agoIndeed, we seem to be OK with things being stored forever, bought and sold without oversight or consent, when they could've been on a local piece of paper or never written down at all.
- systems_glitch 3y agoI was commenting w.r.t. employer-mandated tests of some kind. I don't know about other countries' situation, but here in the USA we have things like insurance companies at least considering the possibility of buying up data from things like 23andme and using that data to adjust your premiums.
- worksonmine 3y ago[flagged]
- add-sub-mul-div 3y agoBecause the covid outrage industry has gotten boring. It used to be about how we were going to be forced to stay home forever, then it was about how we'd be forced to wear masks forever, and now that that stuff didn't come to pass it's fizzling out as the people who still have a chip on their shoulder need to find some passive aggressive way to be outraged and oppressed.
- asynchronous 3y agoI’m not gonna forget how absolutely ludicrously long all that did last, and making it out to be “just two weeks” isn’t going to change anything.
- VancouverMan 3y agoKeep in mind that the experiences that people had during 2020, 2021, and 2022 differed a lot based on where they were located. Across Canada as a whole, for example, there were a lot of harsh, extremely harmful, and blatantly stupid "public health" policies that were forced on the general public pretty much the entire time. Quebec tended to be far more totalitarian about the restrictions than the other provinces, though. People in Quebec had to endure awful curfews, for example, while that generally wasn't the case elsewhere in the country. Toronto forced masking months before it was forced across the entire province of Ontario. The "unvaccinated" people, including those who were perfectly healthy the entire time, also faced significant discrimination and harm into late 2022, well after it was obvious that many people who'd taken numerous shots were still getting sick. Also, a significant number of people lost jobs, lost their businesses, lost educational opportunities, were prevented from visiting with dying loved ones, were prevented from holding and/or attending funerals, and otherwise suffered other irreparable damage. Maybe you lucked out and were in an area where the restrictions weren't too bad. That certainly wasn't the case for everybody, though. Lots of people went through prolonged and completely unnecessary suffering, and they will never forget how they were harmed.
- paradox-hertz 3y ago[dead]
- bearjaws 3y agoSo the company getting hacked isn't to blame? Thats like blaming your employer if the background check company gets hacked. Companies have standards, they use other companies to assess those standards, the blame is on those companies who were compromised. Unless your employer knew they were picking a known vulnerable vendor, you're just looking for outrage at covid testing.
- tlivolsi 3y agoWhere did I absolve the medical company of wrongdoing for not securing this data?
- uoaei 3y agoIt is possible for people to train themselves to recognize dog whistles like yours.
- tlivolsi 3y agoWhat am I dog whistling exactly? Do tell.
- stonogo 3y agoGenerally, the use of the word 'coerced' involves threat of force, which approximately zero employers invoked. When you use it to describe conditions of employment, you're conflating violence with company policy. Most people at this point are going to infer that you have some kind of problem with the pandemic response, whether they agree with you or not. So, that's likely the dogwhistle being referred to here. Meanwhile, if you are making a good-faith argument that employers have too much control over their employees' health care, feel free to get involved with organizing labor unions.
- tlivolsi 3y ago>Generally, the use of the word 'coerced' involves threat of force, which approximately zero employers invoked Yes. Forcing someone to choose between losing their job or undergoing unusual and routine mandatory, invasive medical procedures, which can lead to consequences like those mentioned in the above article, constitutes coercion.
- deleted 3y ago[deleted]
- manzanarama 3y agoI feel frequent data leaks, credit card number leaks, difficulty in un-subscribing or stopping payments after subscribing, etc... makes me appreciate and want to use consolidated sign in / subscription management / payment management options almost exclusively.
- bryanlarsen 3y agoUntil there's a breach of the SSO providers, like the Okta incident.
- gunapologist99 3y agoOkta, Lastpass, Jumpcloud, Authy, Auth0.. the list of hacked SSO providers gets longer by the day.
- anononaut 3y agoDIY or die
- toyg 3y agoIt's a bit like keeping money... You can stash it under your mattress, hoping you'll never suffer a burglary; or you can give it to a bank, and let them spend money on security and insurance. This said, banks have specific fiduciary responsibilities and the above-mentioned insurance, which compensate for the big target they're painting on their own backs; whereas most tech services, even massive ones, tend to hide behind service agreements boiling down to "eh, if it happens it happens, nothing we can do, sucks to be you". Unless they're in healthcare, they're barely required to disclose whether they've been breached, let alone compensate us for the loss of privacy and increased risk of identity fraud that we endure. Maybe it's time for the legislator to define "personal data providers" a bit more rigorously.
- thfuran 3y ago>and increased risk of identity fraud that we endure. The problem is even worse than that. The whole framing of the issue of identity theft as a thing that happens to a person rather than a bank is problematic. That the bank issued credit in my name to someone other than me really should be entirely their problem, not one that probably messes up my life for years.
- FrustratedMonky 3y agoNot US Gov. -> ""The exposed certificates and other documents were all marked with the name and logo of Coronalab.eu. Although the website appears to be offline, Coronalab is owned by Microbe & Lab, an ISO-certified laboratory based in Amsterdam, Netherlands. According to the NL Times, “CoronaLab is one of the two largest commercial test providers in the Netherlands”.""
- yieldcrv 3y ago[flagged]
- explaininjs 3y ago1. Consider the pandemic response an international hysteria specifically engineered by the global elite to move as much real value up the socioeconomic ladder as possible. 2. Don’t consider the Dutch to be any different. 3. Bingo. The Dutch fit into the diatribe. I don’t understand why you think this would somehow be difficult to contend with.
- yieldcrv 3y agodifficult isn't the word as opposed to "hilarious", "waste of energy", "deaf ears", "lack of focus on what can be controlled"
- FrustratedMonky 3y agoI like to think the Dutch don't fall for conspiracies' as much. But there was that whole 'Tulip mania' thing that happened.
- yieldcrv 3y agotongue in cheek reference but based in a flawed but pervasive understanding of that event government modification of derivatives contracts, war right beyond the border (affecting delivery of supply), total gaps in price discovery possibly due to plague... this is probably one of the worst examples of anything irrational, despite being the poster child
- TriangleEdge 3y ago> ... a non-password protected database that contained nearly 1.3 million records ... Breach is not the word I would use here.
- deleted 3y ago[deleted]
- RockRobotRock 3y agoif you forgot to lock your front door, and your TV was gone, does that count as burglary?
- ipaddr 3y agoDon't have a front door and an open diary was copied with personal info?
- Manfred 3y agoAcquiring something that isn't your property is not legal in most countries. It's not really relevant if it's behind a door.
- TheCapn 3y agoAnd accessing a computer system without proper authorization is often illegal. So I'm not sure what point you're making.
- pizzafeelsright 3y agoIt's negligent on the api side.
- deleted 3y ago[deleted]
- NoPicklez 3y agoYes, it does count as burglary and you would still be a victim of burglary regardless of if you left your front door unlocked. Insurance might decide to not cover you for not having a minimum level of control in place, but you are still a victim of burglary.
- AndrewJajack 3y agoDuring the height of COVID, I was exploring the API design of the top-selling COVID tests on Amazon. Several had wildly unsecured APIs—sequential patient IDs but the results endpoint assumed knowing the “secret” patient ID counted as auth. Or just completely open GraphQL implementations, no different than a password-less db… For anyone considering DIYing a diagnostics program, don’t. But I’m biased (I’m the founder of a YC-backed diagnostics as a service co: https://spotdx.com https://spotdx.com)
- dankwizard 3y ago[flagged]
- radicalbyte 3y agoI was working for the NL government on COVID stuff and the only thing I can say is that it's a shame I'm under NDA. It changed my view of the tech industry and I feel silly for calling colleagues in the past out for what I consider inadequate practices. As all were far above the mean.
- gattilorenz 3y agoWeren’t CoronaCheck and CoronaMelder open source? I would have assumed plenty of people would audit them, but I don’t recall seeing any negative news (jokes on their availability aside)
- radicalbyte 3y agoYeah they're open source and they're great (I worked on both). We put a lot of effort into making them into excellent examples. My original post is referring to other things outside of the Ministry.. My role was deep and broad so I got to see a lot.
- YeBanKo 3y agoI am surprised there isn’t some law in NL that would allow you to expose it either to the public or maybe at least to MPs and not be bound by NDA.
- VadimPR 3y agoI've gotten myself tested by a lab in Amsterdam a few times. What do I do now? I'm in the industry and even I don't have an actionable course to take.
- zooq_ai 3y agoWhat should you do? Thank your lucky stars that you live such a privileged life that you can feel outraged about things that absolutely don't matter
- Biganon 3y agoOK ladies and gentlemen, the news just dropped, privacy regarding medical data "absolutely doesn't matter", presumably because some people have it worse or something!
- zooq_ai 3y agoOnce again, I didn't tell OP to stop fighting this fight. Just a little Thank You prayer before starting that fight
- collyw 3y agoTake another booster, can't be too safe.
- _heimdall 3y agoIs anyone actually surprised? Everything was thrown together in a huge hurry and governments were playing fast and loose with laws and regulations. I'm making no judgement on whether that approach was a net positive or negative here, but the writing was on the wall from day 1 with regards to data security.
- deleted 3y ago[deleted]
- m463 3y agoIt seems that anyone entrusted with private information will eventually be breached. I think that there should be legislation - strong legislation - that protects our society's individuals and their information. Make it an uncomfortable and costly responsibility to collect information, store it temporarily and long-term. Additionally, connecting devices to the internet directly or indirectly should have the same sorts of responsibilities.
- Rygian 3y agoThat's what we have in the EU.
- lr1970 3y agoWe should have well defined mechanisms for sunsetting and destroying data.
- aresant 3y agoAs Charlie Munger said "Show me the incentive I'll show you the outcome" Banks have this dialed in, it's called a "personal guarantee" You lose our money, you're personally bankrupt Pretty well aligns the incentives Find something comparable for data, no question the problem will improve