A bug in an Irish government website that exposed COVID-19 vaccination records took 2 years to publicly disclose

Researcher Aaron Costello discovered in December 2021 a misconfiguration in Ireland's HSE COVID-19 vaccination portal (built on Salesforce Health Cloud) that allowed any registered user to access vaccination administration records and internal documents for over one million residents; the HSE remediated the issue upon notification and reports indicate no unauthorized access was found, though public disclosure was delayed after coordination with government agencies stalled.