Dental contractor set up secret account with access to 4,000 patient records then left the company

PWNED recounts an incident at a dental practice where a forgotten vendor admin account (active for at least three years) had administrative access to a patient database containing about 4,000 records. The auditor removed the unused accounts, implemented vendor offboarding and twice-yearly access reviews, and warns that forgotten "zombie" accounts are common and create serious, unseen risks to protected health information.