COVID-19 test lab accused of exposing 1.3 million patient records to open internet

A password-less, publicly accessible database owned by CoronaLab (a Microbe & Lab subsidiary) exposed an estimated 1.3 million Dutch COVID-19 testing records — including test certificates, appointment records, samples and extensive PII (names, dates of birth, passport numbers, emails). The exposure was discovered by a security researcher who reported difficulty contacting the organization; the database remained open for nearly three weeks before being secured. The incident raises GDPR notification concerns and, per a later Coronalab statement, was attributed to unlawful access to a backup via a former IT supplier and has been reported to the Dutch Data Protection Authority.