# LabCorp Security Lapse Exposed Thousands of Medical Documents **URL:** \ **Category:** News & Articles\ **Tags:** tools, data-recovery\ **Created:** [January 29, 2020, 4:41am UTC](https://onehack.st/t/labcorp-security-lapse-exposed-thousands-of-medical-documents/67377 "2020-01-29T04:41:59Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\ **Post date:** [January 29, 2020, 4:41am UTC](https://onehack.st/t/labcorp-security-lapse-exposed-thousands-of-medical-documents/67377/1 "2020-01-29T04:41:59Z")
A security flaw in LabCorp’s website exposed thousands of medical documents, [like test results containing sensitive health data](https://techcrunch.com/2020/01/28/labcorp-website-bug-medical-data-exposed/). From a report: ![image](https://onehack.st/uploads/default/original/3X/e/5/e57b54f03890aff4d10c4d1cc7413a229e0b9026.jpeg) > _It’s the second incident in the past year after LabCorp said in June that 7.7 million patients had been affected by a credit card data breach of a third-party payments processor. The breach also hit several other laboratory testing companies, including Quest Diagnostics. This latest security lapse was caused by a vulnerability on a part of LabCorp’s website, understood to host the company’s internal customer relationship management system._ Although the system appeared to be protected with a password, the part of the website designed to pull patient files from the back-end system was left exposed. That unprotected web address was visible to search engines and was later cached by Google, making it accessible to anyone who knew where to look. - The cached search result only returned one document – a document containing a patient’s health information. But changing and incrementing the document number in the web address made it possible to access other documents. The bug is now fixed.