Post #1397986
2026-01-09 06:02 UTC
Keith Ng at the Herald has a good summary of what's known and where we're at.
"MMH has confirmed that only a single stolen user account was used in the attack. Posing as a normal user, the hackers were able to trick the application interface into providing the files for 127,000 other users. The control mechanisms meant to stop one user from accessing other users’ files had failed, or did not exist."
It sounds like they accessed one person's files, then trimmed the URL to move up a directory or two where they found paydirt.
So less of a hack, more of a problem with poor or non-existent security.
https://archive.md/EXu2y#selection-4127.0-4127.331
#ManageMyHealth
Replies (4)
-
@airshipper@cloudisland.nz 2026-01-09 06:11
@BobLefridge@mastodon.nz it gets better and better
-
@zeborah@mastodon.nz 2026-01-09 06:29
@BobLefridge@mastodon.nz Oh whaaaaaaaaaaat. When they first mentioned a compromised account, I'd assumed one of their staff got phished and was wondering how they'd partitioned their roles so that this only gave hackers access to some clinics' data. This explains that and is also absolutely *horrifying*. Multiple heads should be rolling for that kind of architecture.
-
@depereo@mastodon.social 2026-01-09 07:07
@BobLefridge@mastodon.nz ahhhhhhhhhhhhhhhhh Ahhhhhhhhhhhhhhh! Whyyyyyyyyyyyyyyyy??!
-
@AngelaAntunovic@mastodon.nz 2026-01-09 07:21
@BobLefridge@mastodon.nz The CEO should be fired. Betcha staff have been pointing out the deficiencies for years.