A major data security lapse has exposed more than 86,000 records containing sensitive information of nurses associated with ESHYFT, a New Jersey-based health tech company that connects healthcare professionals with per-diem shifts at hospitals and long-term care facilities. The breach, which left a misconfigured Amazon Web Services (AWS) S3 storage bucket accessible to the public for months, raises serious concerns about data privacy and cybersecurity in the healthcare sector.
Cybersecurity researcher Jeremiah Fowler discovered the unsecured, unencrypted database on January 4, 2024. Two days later, he alerted ESHYFT about the exposure. The company acknowledged the report and indicated that corrective actions were being taken. However, despite the warning, the cloud storage bucket remained publicly accessible for over a month, finally being secured by March 5.
The exposed database, totaling 108.8 gigabytes, contained 86,341 records, including user profile pictures, facial images, and scanned copies of medical IDs, driver’s licenses, and Social Security cards. Also included were CSV files detailing work schedules, professional certifications, employment agreements, resumes, medical diagnoses, prescription records, and disability insurance claims. Many of the files were labeled with explicit identifiers such as “timecards,” “user addresses,” and “disabled users,” making them highly vulnerable to identity theft and fraud.
Fowler reviewed a sample of the leaked records and found a spreadsheet with over 800,000 entries, listing nurse IDs, healthcare facilities, shift timings, and hours worked. The extent of the exposure, combined with the lack of encryption and password protection, poses a severe risk to healthcare professionals and the institutions employing them. The healthcare sector is a frequent target for cybercriminals who exploit personal data for ransomware attacks, financial fraud, and identity theft.
ESHYFT, which operates in 29 U.S. states and describes itself as “an Uber for nurses,” provides a mobile platform that enables certified nursing assistants (CNAs), licensed practical nurses (LPNs), and registered nurses (RNs) to find work shifts, submit timecards, and receive payments. Given the nature of its service, the company collects vast amounts of sensitive data from healthcare professionals. The exposure of this data not only puts individuals at risk but also raises potential legal and regulatory implications for ESHYFT.
