Introduction

A data exposure affecting just over 100,000 individuals including patients, medical professionals and charitable organizations was discovered on August 17th, 2026 by UpGuard researchers. The exposed dataset contained a mixture of personally identifiable information for involved individuals and medical diagnoses for around 67% of them. The exposure stemmed from an Elasticsearch server misconfigured to allow public access to the data. The server belonged to UK-based Liberating Research, a medical survey company that pays patients and medical professionals to answer questions related to their conditions and specialties, with a portion of earnings donated to a charity of the participant's choice.

Medical diagnoses and underlying health conditions represent some of the most intimate details of a person's life. The exposure of such information can carry severe risks, ranging from spearphishing, targeted extortion, employment and insurance discrimination, to intense social stigma and loss of personal dignity. These data exposures usually originate from one of three sources within the healthcare ecosystem: providers (including pharmacies, hospitals, urgent care organizations and diagnostic labs), insurers/health plans, and third party vendors that handle data on behalf of these other organizations. This case falls outside of those three vectors, being a tertiary service that relies on individuals self-reporting their own diagnoses outside of usual medical channels. However, any dataset combining PII and medical diagnoses creates the same risk, and when that dataset is exposed, the individuals described within face the same consequences.

Timeline

UpGuard researchers discovered and analyzed the exposed Elasticsearch server on August 17th (PST). After determining the sensitivity and attributing the data, Liberating Research was notified that same day, albeit after the close of business in Europe. The next morning of August 18th (PST), the server was confirmed secured, demonstrating an immediate response to the exposure. 

After waiting two weeks with no reply, UpGuard emailed Liberating Research on September 1st to ask if they had an estimate for when they would complete any notification to governments or users. On September 4th, UpGuard emailed again informing Liberating Research we would be publishing a blog post soon but could delay publication until they completed notification to users. Liberating Research replied to ask clarifying questions about the data’s ongoing privacy, which UpGuard answered on September 11. On October 8, UpGuard emailed Liberating Reseach that we would be publishing this blog soon.  UpGuard is unaware whether Liberating Research ever notified affected persons. 

Data Analysis

The exposed Elasticsearch server contained several indices, mostly rotating log files and meta data. One index titled “lr_user” contained 662,365 objects with the PII of 109,700 unique individuals; PHI, including diagnoses and medication details, were present for 73,944 of them. These records spanned a period beginning on 9/21/2015 up to the day of discovery and still growing, revealing a datastore that was both historically comprehensive and currently active.

Affected Individuals And Entities

People With Conditions And Carers

The dataset contained PII and medical conditions for 73,944  unique named individuals. 

This constituted the majority (~67%) of the individuals present in the data. These accounts were either patients themselves (58,965), carers for others (5,708) or both a patient and a carer (9,271). 25 of the patient/carer records did not represent a unique individual, creating a small difference between the total records (73,969) and the total individuals (73,944).

In addition to the named individuals, 16,667 other unnamed individuals without accounts of their own are listed within the carer accounts. Although names are not present, the individuals being cared for have their DOB, gender, medical conditions and medications included, which, with the addition of the full identity of the carer, could be used to discover a specific individual’s name.

The most critical risks also exist here, where identifiable individuals are paired with medical conditions, many sensitive in nature. However, the data set included people beyond those submitting medical data, such as medical professionals and charitable organizations and their contacts.

Redacted screenshot of a patient record from the exposed dataset.

Medical Professionals

The 1,765 medical professionals, largely doctors, present in the dataset, have the same PII exposed as those with conditions, with additional fields for specialty and practice. These appear to be medical professionals who signed up to complete surveys, as Liberating Research offers such surveys to both patients and doctors.

‍

Charitable Organizations

Two types of records existed for charitable organizations: 533 organizational accounts for about 300 unique charities, established to represent the entities themselves, and 16,664 “linked supporter” accounts for individuals representing or working with those entities. These records contained full PII, plus a reference to the organization(s) with whom they were affiliated. 

In addition to large organizations, numerous smaller rare-disease and HIV/AIDS advocacy groups were mentioned as well.

Types of Data Exposed

PII

Of the 93,033 records in the dataset, all of them contained email addresses, countries and phone numbers. 99% of them contained full name, date of birth and gender (coded to 1 or 2). 

The full data break down:

Medical Conditions

The data contains 160,778 separate medical conditions, distributed among 73,944 people. 

The conditions with the most records reflect the most common conditions encountered in the home countries of the people being surveyed. Because each condition can be tied back to the full identity of the individuals that have it, sensitive diagnoses such as HIV+ or AIDS could be used for targeted harassment and discrimination. Although not present among the top 15, other sensitive conditions included drug and alcohol abuse, sickle cell disease and various mental conditions beyond anxiety and depression such as bipolar and borderline disorders.

Geographic Distribution

The individuals in this data set came largely from the United States (30.8%), England (29.2%) and Europe (28.1%), with a small percentage living in Canada, Australia and other countries. 

Why It Matters

In 2019, UpGuard secured a similar data leak of medical diagnoses from an organization on the periphery of the healthcare industry. In that case participants provided their medical information to Neoclinical in order to be matched with appropriate clinical trials. Like Liberating Research, the responsible entity was not a healthcare provider but was still a processor of diagnoses in virtue of their participation in the medical economy. Also like the Liberating Research case, UpGuard’s research practice discovered and reported the data before any malicious actors, thereby preventing exploitation.

Other cases illustrate what can happen when security researchers are not able to prevent exploitation.

In 2020, the Vastaamo data breach saw the exposure of approximately 30,000 people’s medical data, including mental disorders, drug use and therapy notes. This data was then used in an attempt to extort both Vastaamo and each of the 30,000 individuals personally. To prove they had the data, the culprits posted unredacted blocks of the dataset, fully exposing many people’s private medical details. Thousands of victims have suffered anxiety, insecurity, and stress from this traumatic event, and the psychological effects from the trauma are long-lasting. This incident brought cybersecurity into the fore in Finland and led to several regulatory reforms, while Vastaamo was hit with a 608,000 Euro fine and its then CEO personally charged with a data protection crime.

Fortunately, this dataset exposes less medical information than the Vastaamo incident; however, revealing even a medical diagnosis can be enough to cause someone harm, particularly when those conditions already face social stigmas like HIV and AIDS. Furthermore, although attributes like gender (99% of all records) and race (57% of all records) were encoded as digits, it is a trivial matter to reasonably decode them. For example, the group of people in the dataset reporting a sickle cell condition were disproportionately of a particular race code. The PII present was sufficient to reidentify natural persons and confirm their race and gender. 

PII datasets that can be filtered by race have been used for mass harassment campaigns by racist extremists, such as in 2023, when the actors responsible for the 23&Me data leak compiled a list of one million people with “Ashkenazi Jewish DNA” from the data and published it. Shortly thereafter, another list of 100,000 people with “Chinese descent” was published. These were intentional, racially-motivated actions intended to lead directly to the harassment of the exposed individuals. The victims of the breach were ultimately awarded $47 million dollars as a result of the privacy violation.

The importance of protecting sensitive medical and biological data goes beyond the normal PII risks of identity fraud, where the real world consequences can be psychologically and socially disastrous for the people who have been exposed. Regulations such as CRA and GDPR are designed to protect citizens, and companies, against these risks by ensuring they take proper measures to maintain data privacy and service integrity. As the Minister of the Interior of Finland said after the Vastaamo attack, such exposures “erode public trust in authorities and create a general sense of insecurity.” If we seek to build a society where people can trust their sensitive data to the institutions and organizations that handle it, we must first establish trustworthy technology.