A Dentist’s Ghost Login Sat Open for 3 Years With 4,000 Patient Files — And Nobody Knew It Was There
A Dentist’s Ghost Login Sat Open for 3 Years With 4,000 Patient Files — And Nobody Knew It Was Therea contractor made a secret admin key, ghosted the company, and left the door wide open for 1,000+ days. classic “left on read” but for your medical records.
1 secret admin account · ~4,000 patient records exposed · 3+ years wide open · 6 MORE clinics found doing the same thing
as reported by The Register. the office manager didn’t even know the account existed.
so a random contractor walks into a dental office, quietly cuts himself a master key, does his little job, and dips. except the key still works. for three whole years. and it opens the drawer with 4,000 people’s names, teeth, and health info in it. deadass nobody noticed until a security guy went snooping. this is the digital version of your ex still having a key to your apartment — except your ex is a company that shut down in 2021.
🧩 Dumb Mode Dictionary (read this first, no shame)
| Scary Word | What It Actually Means |
|---|---|
| Admin account | A login with the master key — can see and change everything |
| Orphaned / ghost account | A login nobody uses anymore but nobody turned off. Still works. |
| Offboarding | The “cancel their keys” step when someone leaves a job (that everyone skips) |
| Vendor | An outside company you hire (the scheduling app, the marketing guy, etc.) |
| Audit | Someone going down the full list checking who can get in |
| HIPAA | US law that says clinics MUST protect your health info ( |
details here) |
📖 How we got here (the short version)
- A dental practice hired a contractor. He set up his own admin account — full access.
- He left. Told nobody the account existed. It just… stayed on.
- Fast forward: Chris Kirksey, CEO of a security-audit firm called Direction, runs a routine checkup.
- He finds three admin accounts that shouldn’t be there. One was linked to a scheduling company the office stopped using in 2021.
- The office manager? Had no clue any of them existed. That’s the scary part.
“Nobody worries about the login they forgot even exists, and that is usually the one still wide open years later.” — Kirksey
📊 The receipts (numbers that hit)
| Thing | Number |
|---|---|
| Rogue admin accounts found at ONE clinic | 3 |
| Patient records exposed | ~4,000 |
| Years the door stayed open | 3+ |
| Year the dead vendor was dumped | 2021 |
| Other clinics Kirksey later caught doing this | 6 |
| People who knew the account existed | 0 |
🗣️ Why this is bigger than one dentist
This isn’t a “one dumb dentist” story. It’s everywhere. Every small business — gyms, salons, law offices, that food truck with a Shopify — hires outside people who make logins and then vanish. Nobody keeps a list. Nobody turns anything off.
The wild bit? The dangerous account is never the one you’re watching. It’s the one you forgot existed. Big companies have whole teams for this (CISA even begs people to fix it). Small ones have… vibes. And vibes don’t revoke access.
🧠 The part that makes a senior nerd go 'huh'
Here’s the mind-bender: hacking is hard. But you don’t need to break in if a door was never locked. The single most common way small places get wrecked isn’t some genius exploit — it’s a login that outlived the relationship it came from.
Which means the “skill” here isn’t coding. It’s just being the one person who bothers to make the list and check it twice. That’s it. That’s the whole moat. Boring wins.
Cool. Some Dentist Left a Digital Backdoor Open for 3 Years… Now What the Hell Do We Do? (⊙_⊙)
look — every small business in your town is sitting on a pile of ghost logins right now. that’s not a tragedy, that’s a to-do list with your name on it. here’s how a broke 20-something with a laptop turns “forgotten door” into rent money. 
🕳️ The Ghost Account Hunter
Walk into local clinics, gyms, and law offices with one line: “Want me to find every login that can still touch your data — including the ones you forgot about?” Most owners have never once looked at their own user list.
The play: you’re not hacking anything. You just sit with the owner, open the admin panel of each tool they use, and read the list of who has access out loud. Every dead vendor or ex-employee you find = a “gotcha” moment that sells the next job.
Example: A 24-year-old IT student in Manila DMs 30 local dental + physio clinics on Facebook offering a “free 15-min access checkup.” First clinic had 5 dead logins. He now charges ₱2,500 (~$45) per clinic cleanup and does 4-5 a week. Tools: literally just the admin settings already inside their software.
Timeline: First paying gig in ~7 days of cold DMs. Word-of-mouth kicks in around week 6. Slows once you’ve cleaned every clinic in a 20km radius — then you franchise the pitch to a friend in the next town.
📡 The Vendor Graveyard Map
Here’s the sneaky-smart one. A company’s old software often leaves live accounts behind. And you can find out what software they used to run — from the outside, for free.
Dig through a company’s old website snapshots on the Wayback Machine, their old job posts (“must know X software”), and press releases. Each dead tool = a likely ghost login still breathing inside. Hand them the list. Charge for the map, charge more for the cleanup.
Example: A freelancer in Nairobi builds a one-page “shadow vendor report” for small law firms using only Wayback + LinkedIn job history. Sells the report for $60, upsells the “kill these accounts” service for $150. First month: 8 reports.
🪟 The Offboarding Kill-Switch
Most software does NOT auto-remove someone when they quit or a contract ends. There’s a gap — days to years — where their access just floats. You sell the thing that closes that gap.
Build a dead-simple “when someone leaves, do these 6 things” checklist in a free Notion or Airtable template. Sell the template cheap as a lead magnet — then offer to run it for them every time someone leaves for a small monthly fee.
Example: A 22-year-old in Lagos sells a “Contractor Kill-Switch” Notion pack for $19 on Gumroad, then converts buyers into a $40/month “we double-check your access every month” retainer. 12 retainers = a salary.
🎣 The Free-Audit Trojan Horse
Blackhat energy, white-hat actions. Offer a “first dead login is free — every extra one we find is $20 to kill.” Owners can’t resist “free,” and there’s ALWAYS more than one. You basically get paid per skeleton in their closet.
The genius: you barely spend anything. The “audit” is you reading a user list. The value is that you’re the only person who ever bothered to look.
Example: A part-timer in Karachi runs the “first one free” pitch on small e-commerce shops using Shopify staff account lists. Average shop had 4 stale staff/app logins = $60/visit, 3 visits a day on a good day.
🧾 Be the Dictionary (the SEO land-grab)
When a scary news story creates a new fear, the first person to explain it in plain English owns the search results. Right now there is NO simple “ghost login” guide written for a dentist, not a hacker.
Write the dead-simple cheatsheet: “The Forgotten Login Checklist for Small Business Owners (No Tech Skills Needed).” Free to read. Every reader is a potential audit client. Cross-link it with Have I Been Pwned so people can check if they’re already leaked.
Example: A blogger in Pune publishes one killer guide targeting “how to check who has access to my clinic software,” ranks in ~8 weeks, and funnels readers into a $99 remote audit call. Passive traffic, active money.
🛠️ Follow-Up Actions
| Want to… | Do this |
|---|---|
| Find dead logins fast | Open every tool’s user/staff list, read every name aloud |
| Spot old software | Check the company on Wayback Machine |
| Build the offboarding kit | Free template in Notion or Airtable |
| Sell a digital product | List it on Gumroad |
| Learn the basics free | Read CISA cyber hygiene |
Quick Hits
| If you want… | Then… |
|---|---|
 To protect your OWN stuff |
List every app you gave someone access to. Kill the dead ones tonight. |
 A first-week hustle |
Offer local shops a “free ghost-login checkup” (start here) |
 To know if you’re leaked |
Check your email on Have I Been Pwned |
 A product to sell |
Package an offboarding checklist on Gumroad |
| To actually understand this |
Skim the original story |
the scariest key isn’t the one someone steals — it’s the one you handed out and forgot to ask back.
[/details]
!