Personal data and health information of approximately 16 million Brazilian COVID-19 patients were exposed online, as a hospital employee uploaded a spreadsheet to GitHub containing usernames, passwords and access keys to sensitive government systems.
Among the exposed systems are E-SUS-VE and Sivep-Gripe , two government databases used to store COVID-19 patient data
E-SUS-VE was used to record patients with mild COVID-19 symptoms, while Sivep-Gripe was used to monitor cases that had ended up in the hospital.
The two databases contained sensitive information, such as patient names, addresses, identification details, as well as health-related records, such as medical history and treatments.
The leak became known when a GitHub user discovered the spreadsheet with personal data on the personal GitHub account of an employee of the Albert Einstein Hospital in the city of São Paulo.
The user informed the Brazilian newspaper Estadao, which contacted the hospital and the Brazilian Ministry of Health.
According to Estadao, the personal data of 16 million Brazilian patients was in the two exposed databases. Among the individuals whose data was exposed are the country's President Jair Bolsonaro, his family, seven government ministers and the governors of 17 Brazilian regions.
The spreadsheet was removed from GitHub, while government officials changed passwords and access keys to secure systems .
In recent months, several governments have faced security issues with COVID-19-related apps and databases. For example, vulnerabilities have been identified in apps and systems used in Germany, Wales, New Zealand, India, and elsewhere.
According to a study published by Intertrust in September, about 85% of apps that track the contacts of COVID-19expose data in one way or another.
Source: ZDNet
