# A Dentist's Ghost Login Sat Open 3 Years With 4,000 Patient Files — Nobody Knew It Existed **URL:** \ **Category:** News & Articles\ **Tags:** hacking, privacy, earn-money, tips-tricks, news\ **Created:** [September 10, 2026, 2:43pm UTC](https://onehack.st/t/a-dentists-ghost-login-sat-open-3-years-with-4-000-patient-files-nobody-knew-it-existed/325466 "2026-09-10T14:43:34Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Hannah](https://onehack.st/user_avatar/onehack.st/hannah/32/174875_2.png) [@Hannah](https://onehack.st/u/Hannah)\ **Post date:** [September 10, 2026, 2:43pm UTC](https://onehack.st/t/a-dentists-ghost-login-sat-open-3-years-with-4-000-patient-files-nobody-knew-it-existed/325466/1 "2026-09-10T14:43:35Z")
# 🦷 A Dentist’s Ghost Login Sat Open for 3 Years With 4,000 Patient Files — And Nobody Knew It Was There _a contractor made a secret admin key, ghosted the company, and left the door wide open for 1,000+ days. classic “left on read” but for your medical records._ **1 secret admin account · ~4,000 patient records exposed · 3+ years wide open · 6 MORE clinics found doing the same thing** as reported by [The Register](https://www.theregister.com/security/2026/09/10/dental-contractor-set-up-secret-account-with-access-to-4000-patient-records-then-left-the-company/5295361). the office manager didn’t even know the account existed. ![Dentist GIF](https://media.giphy.com/media/3o7TKEHmI3JW5M36eY/giphy.gif) so a random contractor walks into a dental office, quietly cuts himself a master key, does his little job, and dips. except the key still works. for three whole years. and it opens the drawer with 4,000 people’s names, teeth, and health info in it. deadass nobody noticed until a security guy went snooping. this is the digital version of your ex still having a key to your apartment — except your ex is a company that shut down in 2021. > **🧩 Dumb Mode Dictionary (read this first, no shame)** > > | Scary Word | What It Actually Means | > | --- | --- | > | **Admin account** | A login with the master key — can see and change everything | > | **Orphaned / ghost account** | A login nobody uses anymore but nobody turned off. Still works. | > | **Offboarding** | The “cancel their keys” step when someone leaves a job (that everyone skips) | > | **Vendor** | An outside company you hire (the scheduling app, the marketing guy, etc.) | > | **Audit** | Someone going down the full list checking who can get in | > | **HIPAA** | US law that says clinics MUST protect your health info ( | > > [details here](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act)) | > **📖 How we got here (the short version)** > > - A dental practice hired a contractor. He set up his own **admin account** — full access. > - He left. Told nobody the account existed. It just… stayed on. > - Fast forward: **Chris Kirksey** , CEO of a security-audit firm called [Direction](https://www.theregister.com/security/2026/09/10/dental-contractor-set-up-secret-account-with-access-to-4000-patient-records-then-left-the-company/5295361), runs a routine checkup. > - He finds **three** admin accounts that shouldn’t be there. One was linked to a scheduling company the office **stopped using in 2021**. > - The office manager? Had no clue any of them existed. That’s the scary part. > > > _“Nobody worries about the login they forgot even exists, and that is usually the one still wide open years later.”_ — Kirksey > **📊 The receipts (numbers that hit)** > > | Thing | Number | > | --- | --- | > | Rogue admin accounts found at ONE clinic | 3 | > | Patient records exposed | ~4,000 | > | Years the door stayed open | 3+ | > | Year the dead vendor was dumped | 2021 | > | Other clinics Kirksey later caught doing this | 6 | > | People who knew the account existed | 0 | > **🗣️ Why this is bigger than one dentist** > > This isn’t a “one dumb dentist” story. It’s _everywhere_. Every small business — gyms, salons, law offices, that food truck with a Shopify — hires outside people who make logins and then vanish. Nobody keeps a list. Nobody turns anything off. > > The wild bit? The dangerous account is never the one you’re watching. It’s the one you **forgot existed**. Big companies have whole teams for this ([CISA even begs people to fix it](https://www.cisa.gov/topics/cyber-hygiene)). Small ones have… vibes. And vibes don’t revoke access. > **🧠 The part that makes a senior nerd go 'huh'** > > Here’s the mind-bender: hacking is hard. But you don’t need to _break in_ if a door was never locked. The single most common way small places get wrecked isn’t some genius exploit — it’s a login that outlived the relationship it came from. > > Which means the “skill” here isn’t coding. It’s just being the one person who bothers to **make the list and check it twice**. That’s it. That’s the whole moat. Boring wins. #### Cool. Some Dentist Left a Digital Backdoor Open for 3 Years… Now What the Hell Do We Do? (⊙\_⊙) ![Opening a locked door with a key GIF](https://media.giphy.com/media/ZFKlmVEFRcsMKVQl6v/giphy.gif) look — every small business in your town is sitting on a pile of ghost logins right now. that’s not a tragedy, that’s a to-do list with your name on it. here’s how a broke 20-something with a laptop turns “forgotten door” into rent money. 👇 > **🕳️ The Ghost Account Hunter** > > Walk into local clinics, gyms, and law offices with one line: _“Want me to find every login that can still touch your data — including the ones you forgot about?”_ Most owners have never once looked at their own user list. > > The play: you’re not hacking anything. You just sit with the owner, open the admin panel of each tool they use, and read the list of who has access out loud. Every dead vendor or ex-employee you find = a “gotcha” moment that sells the next job. > > 🧠 _Example:_ A 24-year-old IT student in **Manila** DMs 30 local dental + physio clinics on Facebook offering a “free 15-min access checkup.” First clinic had 5 dead logins. He now charges ₱2,500 (~$45) per clinic cleanup and does 4-5 a week. Tools: literally just the [admin settings](https://en.wikipedia.org/wiki/Identity_management) already inside their software. > > > 📈 **Timeline:** First paying gig in ~7 days of cold DMs. Word-of-mouth kicks in around week 6. Slows once you’ve cleaned every clinic in a 20km radius — then you franchise the pitch to a friend in the next town. > **📡 The Vendor Graveyard Map** > > Here’s the sneaky-smart one. A company’s _old_ software often leaves _live_ accounts behind. And you can find out what software they used to run — from the outside, for free. > > Dig through a company’s old website snapshots on the [Wayback Machine](https://web.archive.org/), their old job posts (“must know X software”), and press releases. Each dead tool = a likely ghost login still breathing inside. Hand them the list. Charge for the map, charge more for the cleanup. > > 🧠 _Example:_ A freelancer in **Nairobi** builds a one-page “shadow vendor report” for small law firms using only Wayback + LinkedIn job history. Sells the report for $60, upsells the “kill these accounts” service for $150. First month: 8 reports. > > > 📈 **Timeline:** First report sellable same-day once you know the trick. The angle stays fresh for months because almost nobody connects “old website” to “live backdoor.” > **🪟 The Offboarding Kill-Switch** > > Most software does NOT auto-remove someone when they quit or a contract ends. There’s a gap — days to _years_ — where their access just floats. You sell the thing that closes that gap. > > Build a dead-simple “when someone leaves, do these 6 things” checklist in a free [Notion](https://www.notion.com/) or [Airtable](https://www.airtable.com/) template. Sell the template cheap as a lead magnet — then offer to _run it for them_ every time someone leaves for a small monthly fee. > > 🧠 _Example:_ A 22-year-old in **Lagos** sells a “Contractor Kill-Switch” Notion pack for $19 on [Gumroad](https://gumroad.com/), then converts buyers into a $40/month “we double-check your access every month” retainer. 12 retainers = a salary. > > > 📈 **Timeline:** Template earns from day one. Retainers build slowly (2-3/month). Realistically caps around 30-40 clients before you need help — that’s a good problem. > **🎣 The Free-Audit Trojan Horse** > > Blackhat _energy_, white-hat _actions_. Offer a “first dead login is free — every extra one we find is $20 to kill.” Owners can’t resist “free,” and there’s ALWAYS more than one. You basically get paid per skeleton in their closet. > > The genius: you barely spend anything. The “audit” is you reading a user list. The value is that you’re the only person who ever bothered to look. > > 🧠 _Example:_ A part-timer in **Karachi** runs the “first one free” pitch on small e-commerce shops using [Shopify staff account lists](https://www.shopify.com/). Average shop had 4 stale staff/app logins = $60/visit, 3 visits a day on a good day. > > > 📈 **Timeline:** Cash in week one. Burnout risk is real — it’s grind work. Automate the outreach (or hire a cousin to book appointments) by month 2 or you’ll plateau fast. > **🧾 Be the Dictionary (the SEO land-grab)** > > When a scary news story creates a new fear, the first person to explain it in plain English owns the search results. Right now there is NO simple “ghost login” guide written for a dentist, not a hacker. > > Write the dead-simple cheatsheet: _“The Forgotten Login Checklist for Small Business Owners (No Tech Skills Needed).”_ Free to read. Every reader is a potential audit client. Cross-link it with [Have I Been Pwned](https://haveibeenpwned.com/) so people can check if they’re already leaked. > > 🧠 _Example:_ A blogger in **Pune** publishes one killer guide targeting “how to check who has access to my clinic software,” ranks in ~8 weeks, and funnels readers into a $99 remote audit call. Passive traffic, active money. > > > 📈 **Timeline:** SEO is slow — real traffic in 6-10 weeks. But once you rank, it feeds every other hustle on this list for free. Long game, biggest payoff. > **🛠️ Follow-Up Actions** > > | Want to… | Do this | > | --- | --- | > | Find dead logins fast | Open every tool’s user/staff list, read every name aloud | > | Spot old software | Check the company on [Wayback Machine](https://web.archive.org/) | > | Build the offboarding kit | Free template in [Notion](https://www.notion.com/) or [Airtable](https://www.airtable.com/) | > | Sell a digital product | List it on [Gumroad](https://gumroad.com/) | > | Learn the basics free | Read [CISA cyber hygiene](https://www.cisa.gov/topics/cyber-hygiene) | **⚡ Quick Hits** | If you want… | Then… | | --- | --- | | 🔒 To protect your OWN stuff | List every app you gave someone access to. Kill the dead ones tonight. | | 💰 A first-week hustle | Offer local shops a “free ghost-login checkup” ([start here](https://web.archive.org/)) | | 🕵 To know if you’re leaked | Check your email on [Have I Been Pwned](https://haveibeenpwned.com/) | | 🧾 A product to sell | Package an offboarding checklist on [Gumroad](https://gumroad.com/) | | 🧠 To actually understand this | Skim [the original story](https://www.theregister.com/security/2026/09/10/dental-contractor-set-up-secret-account-with-access-to-4000-patient-records-then-left-the-company/5295361) | _the scariest key isn’t the one someone steals — it’s the one you handed out and forgot to ask back._ [/details] ---
**Author:** ![GhostX](https://onehack.st/user_avatar/onehack.st/ghostx/32/177127_2.png) [@GhostX](https://onehack.st/u/GhostX)\ **Post date:** [September 10, 2026, 2:58pm UTC](https://onehack.st/t/a-dentists-ghost-login-sat-open-3-years-with-4-000-patient-files-nobody-knew-it-existed/325466/2 "2026-09-10T14:58:07Z")
Started with a forgotten admin account, ended with a side hustle. What a journey.