[Breaches](/breaches) Clinical Trials: How Personal Information for Thousands of Australians was Exposed [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Clinical Trials: How Personal Information for Thousands of Australians was Exposed ##### [UpGuard Team](/team/upguard) Published Aug 07, 2019 ##### Join 27,000+ cybersecurity newsletter subscribers UpGuard can now disclose that a database containing personal information for over thirty-seven thousand individuals has been secured, preventing any future abuse. The database belonged to Neoclinical, an Australia-based company that matches individuals with active clinical trials. In reviewing the data set, the vast majority of individuals affected were in Australia and New Zealand, where Neoclinical operates clinical sites. In addition to contact information, the database included users’ responses to questions qualifying them for clinical trials, which included questions about medical diagnoses, illicit drug use, and treatments.  ## The Discovery On July 1, an UpGuard researcher detected a MongoDB database named “neoclinical.” The database included collections for different entity types involved in connecting users to clinical trials: the accounts for the medical organizations running the trials, qualifying questions to determine the fit of the users, the “users” themselves seeking entry to those trials, and more. That day the researcher sent an email notification to [Neoclinical](https://neoclinical.com). The researcher called both phone numbers on Neoclinical’s website, one of which was disconnected and the other was configured to record a ten second message to be transcribed and sent as text. On July 25 the researcher escalated notification to AWS Security, which followed their standard procedure of responding that they would notify the owner of the database. On July 26, public access to the database was removed.  ## The Significance Modern medicine is an advanced, specialized practice, and for that reason medical procedures are typically constrained to dedicated sites, like a hospital or doctor’s office. Efforts to protect medical data likewise focus on threats to those sites, like mitigating the [ransomware](/blog/ransomware) attacks (like [WannaCry](/blog/wannacry)) that have struck many hospitals. The data generated from medical examinations, however, can enter other circuits of the digital world, sidestepping the regulation of the hospital. Neoclinical is one example of a company filling a particular role in the larger economy of healthcare that extends far beyond the relationship between doctor and patient within the protections of the hospital. Research and development of new therapies is one part of healthcare writ large, and clinical trials are a subset of that development process. To confirm the effectiveness of a course of treatment requires a scientific study of the therapy’s effect with a statistically significant group of patients. Vetting individuals for inclusion in those trials requires gathering information about their health. In the case of the Neoclinical dataset, that information includes individuals revealing personal information their conditions ranging from cancer to incontinence.  The Neoclinical website claims they have 37,170 users, and that is exactly the number of rows in the “users” collection of their database. Each of those users has a profile with a collection of information describing their fit for the various trials being coordinated with Neoclinical. Part of the profile is personal information like name, email address, physical address, geo coordinates for that address, and date of birth. Additionally, the user information includes their responses to the questions and any trials for which they qualified. Each of those users has entered the Neoclinical system for the purpose of participating in a clinical trial. Whether they qualify for a trial depends on their responses to questions about their medical history. Some questions are about the frequency or severity of symptoms, while others are about past treatments.  ‍ ‍ ## Conclusion Without exposing documents produced by a physician– what one often thinks of as the model of “medical data”– these profiles reveal information about participants' medical histories. That information includes information generated by their interaction with the healthcare industry, like diagnoses and past treatments, as well as reports of their personal experiences related to their health. For individuals, this case provides a reminder that whenever they pass information to a third party, they should consider the impact of that data being exposed. And for companies, it should highlight the importance of having an [incident response](/blog/incident-response-plan) capability so that when data leaks occur, they can be mitigated within hours rather than weeks.  ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)