A data exposure affecting Liberating Research, a UK-based medical survey company, was disclosed after UpGuard researchers identified an Elasticsearch server misconfigured to allow public access to the data. The server stored a mix of personally identifiable information (PII) and medical diagnoses, with the exposed dataset covering records from 21 September 2015 up to the date of discovery, and continuing to grow.
UpGuard’s report indicates the index “lr_user” contained 662,365 objects, comprising PII for 109,700 unique individuals and protected health information (PHI), including diagnoses and medication details, for 73,944 of them. The breach thus involved a combination of seemingly anonymised data and health data, heightening risks such as targeted phishing, extortion, and potential discrimination.
Liberating Research has stated on its site that data collection relies on patient self-reporting and aims to anonymise information, but the exposed datastore undermines those assurances due to the presence of unanonymised PHI alongside PII. The Privacy notice, updated after UpGuard’s notification, emphasises safeguards like firewall protection, access controls, and encryption, yet the misconfiguration caused visibility of sensitive records to the internet.
The incident raises questions about notification obligations; DataBreaches[.]net notes that Liberating Research did not reply to questions about notifying affected individuals or the Information Commissioner’s Office. The report underlines the broader vulnerability of third‑party data handling in health-related research, where datasets combining PII and health data can create substantial risk even when the service is not a HIPAA-covered entity.