The results showed at least 10,000 documents were exposed.

This allowed us to see if a document was on the server without accessing large amounts of patient information, and thus preventing any further exposure to the patient’s privacy. Using computer commands, we determined the approximate number of exposed documents by asking the exposed server if a document existed by returning certain properties about the file - such as its size - but not the document itself. But changing and incrementing the document number in the web address made it possible to access other documents. The cached search result only returned one document - a document containing a patient’s health information.

That unprotected web address was visible to search engines and was later cached by Google, making it accessible to anyone who knew where to look. Although the system appeared to be protected with a password, the part of the website designed to pull patient files from the back-end system was left exposed. This latest security lapse was caused by a vulnerability on a part of LabCorp’s website, understood to host the company’s internal customer relationship management system. That breach also hit several other laboratory testing companies, including Quest Diagnostics. It’s the second incident in the past year after LabCorp said in June that 7.7 million patients had been affected by a credit card data breach of a third-party payments processor.

A security flaw in LabCorp’s website exposed thousands of medical documents, like test results containing sensitive health data.

Trove free class with uk trove glitch