Serviceaide Exposes Sensitive Data of Over 480,000 Catholic Health Patients
Software development firm Serviceaide has accidentally leaked sensitive data belonging to more than 480,000 patients from Catholic Health, a U.S. healthcare provider.
The breach was discovered in November of last year when Serviceaide found that an Elasticsearch database it managed for Catholic Health had been unintentionally made publicly accessible. Upon discovery, the company secured the database and began an internal investigation.
The investigation revealed that the data was exposed between September and November 2024. The information made public may have included the following:
- Full names
- Social Security numbers
- Dates of birth
- Medical record numbers
- Patient account numbers
- Medical and health-related information
- Health insurance details
- Prescription and treatment data
- Clinical information
- Names and locations of providers
- Email addresses, usernames, and passwords
This type of data is highly valuable on the black market, as health records often remain unchanged over time. Cybercriminals can use such information to carry out identity theft, targeted phishing, and financial fraud. Threat actors could potentially use the leaked data to open new credit lines, make unauthorized purchases, or apply for loans under false identities.
Serviceaide has stated there is no current evidence of the data being copied or used for malicious purposes but acknowledged that it cannot rule out this possibility.
Although the company did not provide an exact number of affected individuals, data from the U.S. Department of Health and Human Services indicates that over 483,000 people were impacted. The breach has been categorized as “unauthorized access or disclosure” rather than a hacking or IT-related incident.
Serviceaide has begun notifying affected patients and says it has implemented enhanced security measures to prevent similar events in the future. The company also reminded consumers that they are entitled to one free credit report each year from Equifax, Experian, and TransUnion, as allowed under U.S. law.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
