Exposed! How a Single API Flaw Put Millions of Medical Records at Risk 🚨

CloudSEK’s BeVigil discovered critical API misconfigurations in a healthcare diagnostics provider where a publicly accessible JavaScript file leaked API keys, authentication tokens, and endpoints; this allowed retrieval of PII and medical reports (using sequential lab numbers) and exposed an email-sending endpoint that could facilitate phishing. The report outlines the scale and impact—identity theft, patient safety risks, legal liability and trust erosion—and recommends mitigations including OAuth2, key rotation, rate limiting, RBAC, and API gateway protections.