Bolton Walk-In Clinic patient data leak locked down (finally!)

A publicly reported data leak exposed an unsecured backup of Bolton Walk-In Clinic patient records (approximately 54,000 image files, 877,000 PDFs, ~386 GB) accessible without authentication from at least May 2024 until June 2025; repeated responsible-disclosure notifications were ignored by the clinic, and the exposure was only closed after intervention by a researcher, the ISP (Rogers), and Ontario law enforcement. The article calls for regulatory complaint and patient notification and recommends improvements to incident response and responsible-disclosure handling.