Personally identifiable information belonging to roughly 90% of Panama citizens were exposed on a poorly configured Elasticsearch server.
Security researcher Bob Diachenko discovered an unprotected Elasticsearch server exposing personally identifiable information belonging to nearly 90% of Panama citizens.
Exposed data includes full names, birth dates, national ID numbers, medical insurance numbers, and other personal data.
The database contained 3.4 million records related to Panamanian citizens, labeled as “patients,” and 468,086 records labeled as “test-patient.”
“On May 10th I identified a massive bulk of data sitting in an unprotected and publicly available Elasticsearch cluster (hence visible in any browser).” reads the blog post published by Diachenko.
“This database contained 3,427,396 records with detailed information on Panamanian citizens (labeled as ‘patients‘), plus 468,086 records with records labeled as ‘test-patient‘ (although, this data also appeared to be valid and not purely test data).”
The expert reported his discovery to CERT Panama, and within 48 hours the database has been secured.
At this time, it is unclear who was running the poorly secured server, anyway the exposed information appears to be authentic.
Querying the Shodan search engine service, the researcher discovered that the IP address associated with the unprotected server has been indexed since April 24th, 2019. Of course, it is impossible to determine if anyone else has accessed the data.
“The danger of having an exposed Elasticsearch or similar NoSql databases is huge.” concludes Diachenko. “I have previously reported that the lack of authentication allowed the installation of malware or ransomware on the MongoDB servers. The public configuration allows the possibility of cybercriminals to manage the whole system with full administrative privileges.” “Once the malware is in place criminals could remotely access the server resources and even launch a code execution to steal or completely destroy any saved data the server contains.”
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.