Personal data of 243 million Brazilians left open online for months

(Image credit: Shutterstock.com)

More than 243 million Brazilians have had their personal information exposed online due to a source code error present within the website belonging to the country’s ministry of health. The issue, which reportedly left data visible for at least six months, demonstrates yet again that basic cybersecurity protocols remain lacking within many organizations.

According to reports, the personal information of anyone registered with Brazil’s national health system could be viewed through relatively simple methods. Names, addresses, telephone numbers, and medical details could be viewed, including those belonging to some individuals that have since passed away.

The problem centered on the fact that the credentials needed to access the database of personal information could be decoded from the source code of the health service’s website. As website source codes can be accessed via a simple keyboard shortcut, patient records were potentially exposed to a wide number of threat actors.

Security in poor health

Although there is currently no evidence that personal health records were accessed, it remains concerning just how easily they could have been. Heath records can contain highly sensitive information and cyberattackers are able to sell them for sizable sums on the black market.

Perhaps more worrying, the healthcare leak follows evidence of another web portal owned by the Brazilian government displaying similarly lax security credentials. What’s more, it is only a week since a Sao Paolo hospital leaked health information for more than 16 million Brazilian Covid-19 patients.

As healthcare providers have moved to embrace digital technologies they have undoubtedly unlocked a number of new efficiencies. Unfortunately, they have also introduced new vulnerabilities, ones that cyberattackers are always looking to exploit.

Via The Verge

Barclay Ballard

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services.  After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things. 

Latest in Security
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
Latest in News
DeepSeek
DeepSeek’s new AI is smarter, faster, cheaper, and a real rival to OpenAI's models
Open AI
OpenAI unveiled image generation for 4o – here's everything you need to know about the ChatGPT upgrade
Apple WWDC 2025 announced
Apple just announced WWDC 2025 starts on June 9, and we'll all be watching the opening event
Hornet swings their weapon in mid air
Hollow Knight: Silksong gets new Steam metadata changes, convincing everyone and their mother that the game is finally releasing this year
OpenAI logo
OpenAI just launched a free ChatGPT bible that will help you master the AI chatbot and Sora
An aerial view of an Instavolt Superhub for charging electric vehicles
Forget gas stations – EV charging Superhubs are using solar power to solve the most annoying thing about electric motoring