Archer Health was leaking protected health information. Criminals appear to have found it.

Archer Health, an in-home healthcare provider, was leaking protected health information from a misconfigured bucket, according to Website Planet. The unencrypted and non-password-protected database reportedly contained approximately 145k files, totaling 23 GB.

In a limited sampling, the researcher Jeremiah Fowler found medical documents with names, patient ID numbers, SSNs, physical addresses, phone numbers, and other sensitive data, including assessments, home health certifications, plan of care documents and discharge forms. Fowler said he discovered the leak at the end of August, but began reviewing it on 1 and 2 September, with Archer notified on 4 September and responding within 24 hours.

The timeline also notes that on 7 September KillSec3 added Archer Health to their darkweb leak site and leaked what they claimed was 8 GB of the data on 8 September.