Security researcher Bob Diachenko discovered an unprotected Elasticsearch server exposing personally identifiable information belonging to nearly 90% of Panama citizens.
Exposed data includes full names, birth dates, national ID numbers, medical insurance numbers, and other personal data.
The database contained 3.4 million records related to Panamanian citizens, labeled as “patients,” and 468,086 records labeled as “test-patient.”
“On May 10th I identified a massive bulk of data sitting in an unprotected and publicly available Elasticsearch cluster (hence visible in any browser).” reads the blog post published by Diachenko.
“This database contained 3,427,396 records with detailed information on Panamanian citizens (labeled as ‘patients‘), plus 468,086 records with records labeled as ‘test-
The expert reported his discovery to CERT Panama, and within 48 hours the database has been secured.
At this time, it is unclear who was running the poorly secured server, anyway the exposed information appears to be authentic.
Querying the Shodan search engine service, the researcher discovered that the IP address associated with the unprotected server has been indexed since April 24th, 2019. Of course, it is impossible to determine if anyone else has accessed the data.
“The danger of having an exposed Elasticsearch or similar NoSql