Data Security

Attacks leveraging the survey site’s credibility have the potential to enable phishing and disinformation.

Such database misconfiguration has leaked healthcare professionals' full names, birthdates, phone numbers, addresses, email addresses, work experiences, assigned jobs, communications with MNA Healthcare, hashed temporary passwords, and encrypted Social Security numbers.

While Avis has provided the total number of individuals affected by the incident in its filing with the Office of the Maine Attorney General, it has not specified the nature of the intrusion as well as its impact on employees.

The payment processing service said credit card information was accessed in June 2024.

Despite immediately acting to block the infiltration of the targeted business application, attackers' access between Aug. 3 and Aug. 6 enabled the exfiltration of individuals' names and other sensitive details.

More than 120,000 files and over 1.7 million activity logs leaked by the database revealed Confidant Health patients' psychiatry intake notes, medical histories, disclosures of alcohol and other substance abuse, moods, memory, medications, and overall mental state.

An advisory for 18 patched flaws includes one that could enable “full system takeover,” researchers said.

Individuals' full names, birthdates, phone numbers, ID numbers, email addresses, home addresses, vehicle identification numbers, car brands and models, engine numbers, and vehicle colors were leaked by the unsecured Elasticsearch instance.