9 ms·
'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket
- gnabgib 2y agoTitle: Thousands of Records, Including PII, Exposed Online in Healthcare Marketplace Connecting Facilities and Nurses Data Leak (vs current: "'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket")
- booi 2y agoUber for ___ has lost all meaning
- dartos 2y agoWell there be any consequences for the company?
- ilrwbwrkhv 2y agoNo. And hence this will keep happening.
- garciasn 2y agoEven if there are, it’ll be minuscule compared to what is necessary to drive effective change. The fine for one person’s information from this site should be equivalent to their entire revenue for the year; should not be permitted to be resolved by bankruptcy, and should be required to transfer to any company purchasing their assets. Their entire executive team should be jailed for a minimum of 3 years per individual offense. Only then will there be any modicum of an opportunity for us to see some real change.
- aeries 2y agoYour proposal is so bizarrely out of proportion with the harm caused that I can’t tell if it’s parody or not. Why not execute them while you’re at it?
- thfuran 2y agoThat would be cruel and unusual — their families and friends would needlessly suffer. They'll need to be executed too.
- garciasn 2y agoI recommend we summarily execute people who don’t use the middle lane to go straight at an intersection, blocking everyone else from turning right on red; I feel as if jail time for these executives was pretty reasonable.
- richwater 2y ago> Their entire executive team should be jailed for a minimum of 3 years per individual offense. This is so over the top reactionary and stupid, I can't help but write off your entire comment. You want the Chief Accounting Officer to go to jail for 3 decades because of a data breach?
- garciasn 2y agoI assumed there was more than 10 folks impacted by their poor business decisions; based on the number of images of SS cards, it should be life without parole. Preferably with hard labor in Siberia or western Nebraska.
- franktankbank 2y ago> or western Nebraska. Now you've taken it too far.
- piuantiderp 2y agoMaybe 5y
- 1970-01-01 2y agoThis is not so firm. Don't underestimate a wealthy person's medical record going public.
- deleted 2y ago[deleted]
- ethagnawl 2y agoI'll need to dig up a source but I recently heard about this company and, apparently, before offering gigs they do a credit report to determine how much debt the person is carrying (i.e. how desperate they are) and they use that information to _round down_ the hourly rate they offer them. In the unlikely event that there are any negative consequences for this breach, they deserve every bit of them and more.
- wewtyflakes 2y agoThis is abhorrent if true; truly evil behavior.
- timewizard 2y agoIt's amazing that, on a cursory look, only 11 states make this practice illegal. The "AI scriptown" is growing.
- inetknght 2y agoYou might be surprised to learn that they're not the only company to do so.
- speed_spread 2y agoNames. We need names.
- zorpner 2y agoNot of companies. Of the people who choose to work for them (or, rather, choose not to stop working for them after they build these "features").
- vkou 2y agoWe don't need names, we need legislature, and we need to vote for people who will write it, as opposed to grifters who only seek to pad the pockets of billionaires. These predators aren't scared of name and shame. Any publicity is good publicity (And if it actually gets bad, they'll sue the pants off you.). They are scared shitless of laws censuring their behavior. It's why they fight like mad to ensure that they aren't subject to them.
- marcus0x62 2y agoMove fast and violate HIPAA.
- xattt 2y agoDoes HIPAA apply to HR into, or just patient health data?
- ahstilde 2y agoProtected health information (PHI) under U.S. law is any information about health status, provision of health care, or payment for health care that is created or collected by a Covered Entity (or a Business Associate of a Covered Entity), and can be linked to a specific individual. This is interpreted rather broadly and includes any part of a patient's medical record or payment history. source: i run Wyndly (YC W21 https://www.wyndly.com https://www.wyndly.com), which is most easily understood as a telehealth allergist online.
- nradov 2y agoSure, that's the definition of PHI but is ESHYFT a HIPAA covered entity? If not then the definition of PHI isn't legally relevant (although they still have an ethical requirement to secure employee data, and might have violated other data protection laws). https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- SkyPuncher 2y agoYes, but you're missing a massive caveat that is conditional on the definition of "covered entity". Covered Entity has a narrow meaning. Notably, if you don't accept insurance, it's very unlikely you're a covered entity.
- thfuran 2y agoIt considers non-health-specific identifying info about patients that might be stored with the health-specific info to also be PHI.
- jppope 2y agoWorth mentioning, because the authority level of medical practitioners throws people off. Don't ever give a doctor or practice your Social Security Number. They don't need it. Similarly if they want to check an ID that doesn't mean scan or photograph. Doctors, practices, etc are the worst at infosec. They have no training, basically no penalties if they do something wrong and all of that info is only to follow up in case you don't pay your bill.
- thfuran 2y agoIn the US, HIPAA is pretty much the strongest privacy legislation there is. There's probably no group that would have a more severe penalty for leaking your info than your healthcare provider.
- SR2Z 2y agoAnd yet the data still seems to leak pretty frequently...
- jandrese 2y agoHIPAA has strict rules with severe penalties, but enforcement is at best spotty. So honest hospitals and doctors offices bend over backwards to comply with the rules at great expense, but bad actors are rarely punished. It's the worst of both worlds. I'm pretty sure that is why the punishments are so harsh, because they need to put the fear of god into practitioners to make them take it seriously since there are so few inspectors.
- timewizard 2y agoIt's the difference in medical establishment skill level between your doctor and you. You are always at a disadvantage. I've long thought that a disinterested third party needs to be involved. Someone with real oversight taking a position adversarial to the hospital and strictly to create the best possible outcome for the patient. The Hippocratic model isn't awesome.
- 2y ago
- gtirloni 2y agoWhy "Uber for nurses" and not the actual company name in the title?
- Mistletoe 2y agoIt lets me know the company is bullshit in a way the company name never would.
- nick__m 2y agoAccording to the article the name is ESHYFT. It sounds like a brand of electronic found on aliexpress but with less quality!
- ks2048 2y agoPlease invest in my startup, ENSHITIFY
- intelVISA 2y agoWhich one?!
- hotsauceror 2y agoI think I once bought an iPhone charging cable from you guys on Amazon.
- mhitza 2y agoI wonder how old the S3 bucket was, because at some point AWS made new S3 buckets private by default. Which means it's either old, or they recklessly opened it up because they couldn't get files uploaded/downloaded to the bucket from their mobile app/services.
- bpodgursky 2y agoAlso possible a webdev opened it up so they could use the assets on a website, and didn't think about other private data in the bucket.
- CaffeineLD50 2y agoYeah I remember when Amazons AWS was new and people said "hey its cool but not secure." Then AWS added all these security features but added a caveat: BTW security is your responsibility Here we are. I guess we can blame the users and not any shitty security architecture slapped on AWS. Clearly what matters most is that legal culpability be avoided, not that users will be secure. The former is 'shite security' while the latter is good security
- richwater 2y ago> shitty security architecture slapped on AWS It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket. It can be enabled at the account level, and is on _by default_ for any new bucket. What exactly more do you want?
- dragonwriter 2y ago> It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket. I'm reasonably certain that for quite a while blocking all public access has been the default, and it is multiple clicks through scary warnings (through the console; CLI or IaC are simpler) to enable public access.
- CaffeineLD50 2y agoSwimmers on a beach that had lifeguards were dying because the ocean was quite strong and even experienced swimmers would occasionally be drowned. The city decided to remove the life guards and replace them with signs saying "swim here at your own risk, people die here." Having a simple classification system like "public" and non public with a system that ensures non public data isn't published might prevent data leaks with automation that checks for publishing non-public data. A system that let's you publish non public data "with warnings" is just a sign saying "swimmers die here". Its not safe, it just excuses the city from culpability
- wsatb 2y agoThe only mistake AWS made was making buckets originally public by default. It’s been many years since that’s been the case. At this point, you have to be completely ignorant to be storing PII in a public bucket.
- jihadjihad 2y agoIn the section of their Privacy Policy titled Data Security [0]: > We use certain physical, managerial, and technical safeguards that are designed to improve the integrity and security of information that we collect and maintain. Please be aware that no security measures are perfect or impenetrable. We cannot and do not guarantee that information about you will not be accessed, viewed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards. In particular, the Service is NOT designed to store or secure information that could be deemed to be Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). IANAL and all that, but I’m not sure you can use the excuse “We didn’t design our system to be HIPAA compliant, sorry,” and hope your liability disappears. Does anyone know? 0: https://eshyft.com/wp-content/uploads/2019/06/ESHYFT-Privacy-Policy-05-16-2019.pdf https://eshyft.com/wp-content/uploads/2019/06/ESHYFT-Privacy...
- colechristensen 2y ago[Nevermind]
- johann8384 2y agoThe PII of the nurses being accidentally shared by a staffing agency isn't a HIPAA violation. Yes the nurses are providers but their relationship with the Uber for nurses service isn't a medical provider relationship. It's definitely a legal and ethical failing but I don't think it's a HIPAA one.
- DistractionRect 2y agoThis is what I took away from the reading. It's basically a shift/employee management platform. The only reason we're even discussing HIPAA is because health care industry adjacent. If you replaced nurses with gig workers and uber for nurses with something like WeWork this would just be like every other leak we talk about on HN.
- colechristensen 2y ago
- ripped_britches 2y agoWhat makes this uber for nurses?
- ants_everywhere 2y agoIt's Kelly Services for nurses, but Uber sounded cooler 10 years ago
- rad_gruchalski 2y agoMaybe nurses come over by Uber.
- dikaio 2y agoWould be surprised if this company makes it out of this. Medical records…. Yikes
- xyst 2y agoA company of this size definitely wouldn’t be able to tank a multimillion dollar lawsuit.
- SamuelAdams 2y agoI am confused, the article seems to be short on details. Was the attack an open S3 bucket? The company in question seems to be hiring for GCP, so I imagine they don’t use S3 at all. Did the submitter intentionally change the post title to get more clicks? https://eshyft.com/careers/gcp-devops-engineer/ https://eshyft.com/careers/gcp-devops-engineer/
- colechristensen 2y agoMulti-cloud isn't uncommon, especially interacting with vendors. It has been a long time since I've worked somewhere that didn't have at least some usage in more than one cloud provider.
- whatever1 2y agoI thought the cloud was safe, that is why you pay premium.
- morkalork 2y agoThey just sell pick axes, they don't care if you plant one right through your foot.
- whatever1 2y agoNo that is not the sales pitch to enterprise customers. They are pitching that sys admins are stupid and that security nowadays is too complicated, hence cloud is the only safe solution. Yet every month I see a story here about an huge data leak from an unrestricted bucket.
- markus_zhang 2y agoWhat a surprise. How do we, the common people dealing with corporations and governments leaking out information left and right? Even password storage services are not really safe AFAIK.
- 999900000999 2y agoAre y'all gonna blame AWS like you blamed Firebase last week ? The security procedures I take while hacking out something for my friends at 3am should not extend to products hosting PII. It's up to YOU to implement basic data security.
- onion2k 2y agoIt's up to YOU to implement basic data security. You definitely need to do this, but a platform should help where possible, and try to have users fall into a 'pit of success' where if a dev just goes with the defaults everything is fine. In this case, S3 buckets should be private and encrypted by default and devs should need to actively choose to switch those things off (which I think may be the case now, but it wasn't in the past.)
- 999900000999 2y agoThis is like having a small store and instead of locking up at the end of the day, blaming the door for not automatically locking. Yes new automatic locks exist now, but you still need to check. Cloud technology allows us to build fantastic software very fast. But if you’re too lazy to implement a basic api to get S3 data on a needs to know basis, that’s on you. AWS makes this very easy. You can’t blame anyone else.
- jeffhuys 2y ago> S3 buckets should be private and encrypted by default and devs should need to actively choose to switch those things off Yeah, that's the case right now. There's multiple screens you have to go to, that almost scream at you that you're making EVERYTHING PUBLIC. Also, in the overview, it distinctly says "!! PUBLIC".
- bigfatfrock 2y agoSorry for the dude that built their infra and was really tired and then woke up to this, what a bummer.
- elevatedastalt 2y agoAnnual reminder that the P in HIPAA stands for Portability, not Privacy.
- RobotToaster 2y agoWhy does this keep happening? It seems like every month there's a new leak from an open S3 bucket?
- dmix 2y agoNew companies with immature systems, old companies hiring young developers doing side stuff off in their own world, bad default configurations etc Most importantly there's a large amount of highly incentivized people probing constantly at mass scale. These days it's very easy to scan the internet (github, IPs, domains, etc) for information and "bad S3 configuration" detection is just a script anyone can use. No advanced programming skills required.
- reustle 2y agoS3 (and most of AWS) is terribly designed, so you end up googling for access policies that likely work when you are trying to get a new project off the ground. That policy may not be right for prod in the future. Not saying it is right, it's just what happens.
- j45 2y agoI wish private data was more independently audited.
- hrhbbvjhcxb 2y ago[dead]
- albert_e 2y agoThe linked article does not mention Amazon S3 or AWS Is there a different source for the "open S3 bucket" in HN title?
- devonbleak 2y agoI had the same thought. Closest I can tell there's screenshot that looks like s3 console listing csv files if you click over far enough in the carousel.
- arresin 2y agoAlways. Always the open bucket.
- tmpz22 2y agoAre we pretending that there are still functional regulatory agencies that are able to take action over this?
- fads_go 2y agoThe person working the hardest to find these is then immediately shutting them down. Makes government more efficient.
- mordae 2y agoNow if only this data found its way to some union organizer.
- littlestymaar 2y agoWhen do we start making that kind of thing criminal negligence with prison sentences for this kind of bullshit…
- amelius 2y agoIt is really unfair, the way capitalism treats nurses (and police officers, school teachers). Without them, the entire system wouldn't even exist. Capitalism may sound like a great idea at first, but in the end you have a few rich bastards milking the rest.
- piokoch 2y agoIt has nothing to do with capitalism. You can have capitalism and society that is aware that having good public services pays-off, as overall spending on schools, security, etc. will be smaller if done at the whole country level. In the USA it is not that easy to achieve, as, historically, it is not a single country but a union of "states" that is countries, so the main boss should not interfere too much with local bosses and force on them particular "federal" laws.
- amelius 2y agoThat doesn't answer whether it is fair. Capitalism will always push for a smaller government and with all the power they have at their disposal. At the same time, why can capitalists have their rich-making business schemes while nurses and other (semi) public servants are stuck with whatever society decides is good for them? The system is rigged in favor of capitalists.
- _xtrimsky 2y agoit has nothing to do with capitalism. this company could have hired a cheap student, that would have known best AWS practices and would have kept it secure. at the same time a communist government with lots of funds, could have made this mistake.
- user99999999 2y agoClose it. Sell off all the assets and give the proceeds as compensation to those whose data was exposed. Why do we have a human death penalty but not a corporate one?
- game_the0ry 2y agoIncredible. Healthcare is a busted industry through and through. Even the tech companies that serve it are incompetent. There are so many things wrong here: - the uber-fication of nursing, bc of cheap and corporate owned hospitals won't just hire them as w2 employees - cheapness probably led hospitals to this crappy app, which probably gave kick backs to the admins that approved it - this should totally bankrupt the ESHYFT, but more likely nothing will happen
- zero_k 2y agoBankrupt only? It should also be criminal negligence. Until some exec goes to jail, this kind of stuff will keep happening. Someone was (likely is...) making good profit out of this business by not investing in IT security. They cheaped out, and other people paid the price, who didn't have anything to do with the profit of the company. Watch out for the execs going around in a few years giving talks about how to build a successful company. If we let this kind of behaviour have zero repercussions, the public will continue to pay the price of private profits.
- game_the0ry 2y agoDo not disagree here. As long as it is on the CEO and head on eng. No some poor intern.
- franktankbank 2y agoI'm really curious about the kickbacks comment. I'm sympathetic to it but how do you root it out practically? Noone has much incentive to fix it because the people aware of the ill doing are the ones benefiting from it.
- Scoundreller 2y agoTo some extent, apps like this keep independent hospitals/providers viable. A big bad health system will have its own “float” pool of W2 nurses or internal offer system. Heck, that’s part of the “sell” when selling out: to get access to a robust vacation/vacancy handling system.
- only-one1701 2y agoAs an AWS Solution Architect - Associate, I can confidently say they should’ve been using AWS Macie (tongue in cheek btw)
- kittikitti 2y agoHow does the medical and healthcare industry that is notorious for gatekeeping have these problems? Leaving a database open and unprotected is just hard to understand given the levels of red tape you have to complete to develop in this space. Theranos was jailed and defamed whereas this will likely cause more damage as a whole (instead of some billionaires becoming slightly less rich).
- donatj 2y agoHuh, I worked for an agency and built a site that was essentially "Uber for Nurses" back in 2010. I was immediately like "it's not them is it?" No, seems they shut down in 2017. As far as I know, never really took off, at least while I was maintaining it, but the gig economy wasn't in full swing yet. All that said, the sheer number of forms and amount of paperwork the site required you to fill out just to sign up had to have been a limiting factor in getting you in the door. Real high friction getting people in the door. I wonder if Eshyft was able to somehow simplify the process.
- Scoundreller 2y agoYou were probably too early. Covid lead to a wave of quitting, retirements, sick calls and increased health care demand so nurses could flex their spot in the market place and get the new market rate through contracting.
- insane_dreamer 2y ago“Uber for X” has become equivalent to “let’s extract as much value as possible out of X for the benefit of some Big Corp while making the experience as horrible as possible for the people this is supposedly benefits” (drivers, nurses).
- redwoolf 2y agoThis is shameful. S3 buckets have not been public by default for many years. You have to make a choice to make them publicly accessible. And to not have the contents encrypted at rest. I just can’t. The lack of respect that some companies have for their customers is appalling.
- dhab 2y agoI know I won't be able to dig it up, but certain that I read this research paper where they concluded in words to the effect that jobs which require a bit of passion are the most underpaid/overworked - e.g. teachers, nurses, musicians, sports-people.
- localghost3000 2y agoI’ve worked in healthcare tech and this is pretty bad. You get fined per patient record and it’s not cheap. You also get put on a “wall of shame” where anyone who might do business with you in the future can look and see. You can also be held personally liable if you mess up. It’s really intense. At my old job we didn’t even allow PII to pass through our API so we couldn’t accidentally log it and kept all of it in its own VPS totally isolated from the rest of our system. When we needed a record we’d put it into an S3 bucket and hand back temp link that only the caller could access (and expired within a short period of time) Total pain but you could sleep at night.