Dr Lal Path Labs Left Millions of Patients’ Data Exposed on Cloud Storage

Dr Lal Path Labs, one of India’s biggest clinical lab testing companies has left the data of millions of its customers exposed on an unprotected storage bucket hosted on Amazon Web Services. This left sensitive data including medical data of millions of Indians exposed to attacks from malicious actors. The exposed data was found by an Australian security expert named Sami Toivonen, who reported the issue to Dr Lal Path Labs in September last month. Dr Lal Path Labs has since then secured the data and said that the exposed data amounted to about 0.5 percent of its total records.

The development was first reported by TechCrunch, who quoted Toivonen as saying that the exposed data amounted to millions of individual patient bookings. It is not known as to how long the bucket was exposed, and if anyone has maliciously accessed the Dr Lal Path Lab data. The data exposed on the unprotected bucket contained spreadsheets of daily records of patient lab tests. Those spreadsheets contained a patient’s name, address, gender, date of birth, contact number, details of booking, doctor details, limited payment details, patient unique identification numbers, and details and pictures of when, where, and what lab the tests were taken at. Reporters at TechCrunch also verified the details of several patients.