[Breaches](/breaches) Clinical Oversight: Medical Survey Firm Exposes Diagnoses of Participants [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Clinical Oversight: Medical Survey Firm Exposes Diagnoses of Participants ##### [Greg Pollock](/team/greg-pollock) Published Oct 12, 2026 ##### Join 27,000+ cybersecurity newsletter subscribers # Introduction A data exposure affecting just over 100,000 individuals including patients, medical professionals and charitable organizations was discovered on August 17th, 2026 by UpGuard researchers. The exposed dataset contained a mixture of personally identifiable information for involved individuals and medical diagnoses for around 67% of them. The exposure stemmed from an Elasticsearch server misconfigured to allow public access to the data. The server belonged to UK-based Liberating Research, a medical survey company that pays patients and medical professionals to answer questions related to their conditions and specialties, with a portion of earnings donated to a charity of the participant's choice. Medical diagnoses and underlying health conditions represent some of the most intimate details of a person's life. The exposure of such information can carry severe risks, ranging from spearphishing, targeted extortion, employment and insurance discrimination, to intense social stigma and loss of personal dignity. These data exposures usually originate from one of three sources within the healthcare ecosystem: providers (including pharmacies, hospitals, urgent care organizations and diagnostic labs), insurers/health plans, and third party vendors that handle data on behalf of these other organizations. This case falls outside of those three vectors, being a tertiary service that relies on individuals self-reporting their own diagnoses outside of usual medical channels. However, any dataset combining PII and medical diagnoses creates the same risk, and when that dataset is exposed, the individuals described within face the same consequences. # Timeline UpGuard researchers discovered and analyzed the exposed Elasticsearch server on August 17th (PST). After determining the sensitivity and attributing the data, Liberating Research was notified that same day, albeit after the close of business in Europe. The next morning of August 18th (PST), the server was confirmed secured, demonstrating an immediate response to the exposure.  After waiting two weeks with no reply, UpGuard emailed Liberating Research on September 1st to ask if they had an estimate for when they would complete any notification to governments or users. On September 4th, UpGuard emailed again informing Liberating Research we would be publishing a blog post soon but could delay publication until they completed notification to users. Liberating Research replied to ask clarifying questions about the data’s ongoing privacy, which UpGuard answered on September 11. On October 8, UpGuard emailed Liberating Reseach that we would be publishing this blog soon.  UpGuard is unaware whether Liberating Research ever notified affected persons.  # Data Analysis The exposed Elasticsearch server contained several indices, mostly rotating log files and meta data. One index titled “lr\_user” contained 662,365 objects with the PII of **109,700** unique individuals; PHI, including diagnoses and medication details, were present for **73,944** of them. These records spanned a period beginning on 9/21/2015 up to the day of discovery and still growing, revealing a datastore that was both historically comprehensive and currently active. Affected Individuals And Entities | Account Type | Individuals | | ------------------------------------ | ----------- | | Patient / Carer | 73,969 | | “Linked Supporter” (charity contact) | 16,664 | | Healthcare Professional | 1,765 | | Charity / Organization | 533 | | Incomplete / Test Signups | 102 | | Total Accounts | 93,033 | ### People With Conditions And Carers The dataset contained PII and medical conditions for **73,944 ** unique named individuals.  This constituted the majority (\~67%) of the individuals present in the data. These accounts were either patients themselves (**58,965**), carers for others (**5,708**) or both a patient and a carer (**9,271**). **25 **of the patient/carer records did not represent a unique individual, creating a small difference between the total records (**73,969**) and the total individuals (**73,944**). In addition to the named individuals, **16,667** other unnamed individuals without accounts of their own are listed within the carer accounts. Although names are not present, the individuals being cared for have their DOB, gender, medical conditions and medications included, which, with the addition of the full identity of the carer, could be used to discover a specific individual’s name. The most critical risks also exist here, where identifiable individuals are paired with medical conditions, many sensitive in nature. However, the data set included people beyond those submitting medical data, such as medical professionals and charitable organizations and their contacts. Redacted screenshot of a patient record from the exposed dataset. ### Medical Professionals The **1,765** medical professionals, largely doctors, present in the dataset, have the same PII exposed as those with conditions, with additional fields for specialty and practice. These appear to be medical professionals who signed up to complete surveys, as Liberating Research offers such surveys to both patients and doctors. ‍ ### Charitable Organizations Two types of records existed for charitable organizations: **533** organizational accounts for about 300 unique charities, established to represent the entities themselves, and **16,664** “linked supporter” accounts for individuals representing or working with those entities. These records contained full PII, plus a reference to the organization(s) with whom they were affiliated.  In addition to large organizations, numerous smaller rare-disease and HIV/AIDS advocacy groups were mentioned as well. ## Types of Data Exposed ### PII Of the **93,033** records in the dataset, all of them contained email addresses, countries and phone numbers. 99% of them contained full name, date of birth and gender (coded to 1 or 2).  The full data break down: | Data Type | Percentage | Number Of Records | | ------------------------------------------------------------------------------------------------------------ | ---------- | ----------------- | | Email Address | 100% | 93,033 | | County/Region/Country | 100% | 93,033 | | Phone Number | 100% | 93,033 | | Name | 99% | 92,382 | | DOB | 99% | 92,382 | | Gender (Numerically coded) | 99% | 92,382 | | IP Address | 83% | 76,797 | | Medical Information (Does not include the unnamed "cared for" individuals listed within the carer accounts.) | 79% | 73,944 | | Employment Status | 58% | 53,918 | | Ethnicity (Numerically coded) | 57% | 53,144 | ### Medical Conditions The data contains 160,778 separate medical conditions, distributed among 73,944 people.  The conditions with the most records reflect the most common conditions encountered in the home countries of the people being surveyed. Because each condition can be tied back to the full identity of the individuals that have it, sensitive diagnoses such as HIV+ or AIDS could be used for targeted harassment and discrimination. Although not present among the top 15, other sensitive conditions included drug and alcohol abuse, sickle cell disease and various mental conditions beyond anxiety and depression such as bipolar and borderline disorders. ## Geographic Distribution The individuals in this data set came largely from the United States (30.8%), England (29.2%) and Europe (28.1%), with a small percentage living in Canada, Australia and other countries.  | Country | Records | Percentage of total | | ---------------------- | ------- | ------------------- | | United States | 28,684 | 30.8% | | England | 27,209 | 29.2% | | France | 7,423 | 8.0% | | Germany | 7,060 | 7.6% | | Spain | 6,158 | 6.6% | | Italy | 5,492 | 5.9% | | Scotland | 4,322 | 4.6% | | Canada | 3,848 | 4.1% | | Wales | 1,330 | 1.4% | | Northern Ireland | 662 | 0.7% | | Ireland | 239 | 0.3% | | Australia (and others) | \~236 | 0.3% | # Why It Matters In 2019, UpGuard secured [a similar data leak of medical diagnoses](https://www.upguard.com/breaches/data-leak-neoclinical-australia-new-zealand) from an organization on the periphery of the healthcare industry. In that case participants provided their medical information to Neoclinical in order to be matched with appropriate clinical trials. Like Liberating Research, the responsible entity was not a healthcare provider but was still a processor of diagnoses in virtue of their participation in the medical economy. Also like the Liberating Research case, UpGuard’s research practice discovered and reported the data before any malicious actors, thereby preventing exploitation. Other cases illustrate what can happen when security researchers are not able to prevent exploitation. In 2020, the [Vastaamo data breach](https://en.wikipedia.org/wiki/Vastaamo_data_breach) saw the exposure of approximately 30,000 people’s medical data, including mental disorders, drug use and therapy notes. This data was then used in an attempt to extort both Vastaamo and each of the 30,000 individuals personally. To prove they had the data, the culprits posted unredacted blocks of the dataset, fully exposing many people’s private medical details. Thousands of victims have [suffered anxiety, insecurity, and stress ](https://www.csmonitor.com/World/Europe/2021/0319/Extortion-of-therapy-patients-in-Finland-shakes-culture-of-privacy)from this traumatic event, and the psychological effects from the trauma are long-lasting. This incident [brought cybersecurity into the fore](https://www.helsinkitimes.fi/finland/finland-news/domestic/18209-ohisalo-finnish-government-to-talk-about-hacking-on-wednesday.html) in Finland and led to several regulatory reforms, while Vastaamo was hit with a 608,000 Euro fine and its then CEO personally charged with a data protection crime. Fortunately, this dataset exposes less medical information than the Vastaamo incident; however, revealing even a medical diagnosis can be enough to cause someone harm, particularly when those conditions already face social stigmas like HIV and AIDS. Furthermore, although attributes like gender (99% of all records) and race (57% of all records) were encoded as digits, it is a trivial matter to reasonably decode them. For example, the group of people in the dataset reporting a [sickle cell condition](https://en.wikipedia.org/wiki/Sickle_cell_disease) were disproportionately of a particular race code. The PII present was sufficient to reidentify natural persons and confirm their race and gender.  PII datasets that can be filtered by race have been used for mass harassment campaigns by racist extremists, such as in 2023, when the actors responsible for the [23\&Me data leak](https://en.wikipedia.org/wiki/23andMe_data_leak) compiled a list of one million people with “Ashkenazi Jewish DNA” from the data and published it. Shortly thereafter, another list of 100,000 people with “Chinese descent” was published. These were [intentional, racially-motivated actions](https://www.nytimes.com/2024/01/26/business/23andme-hack-data.html) intended to lead directly to the harassment of the exposed individuals. The victims of the breach were ultimately [awarded $47 million dollars](https://www.bbc.com/news/articles/cn0vnx2192vo) as a result of the privacy violation. The importance of protecting sensitive medical and biological data goes beyond the normal PII risks of identity fraud, where the real world consequences can be psychologically and socially disastrous for the people who have been exposed. Regulations such as CRA and GDPR are designed to protect citizens, and companies, against these risks by ensuring they take proper measures to maintain data privacy and service integrity. As the Minister of the Interior of Finland said after the Vastaamo attack, such exposures “erode public trust in authorities and create a general sense of insecurity.” If we seek to build a society where people can trust their sensitive data to the institutions and organizations that handle it, we must first establish trustworthy technology. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)