Perfectshift leak exposes healthcare credentials

Names, payroll data, hashed passwords, and thousands of other sensitive records belonging to Stanford Health Care’s staff were exposed after a third-party contractor, Perfectshift, left an unprotected database accessible to the public.

The Cybernews research team discovered the leak in late August, after noticing an unprotected MongoDB database hosted by Perfectshift, a healthcare workforce management services provider.

According to our team, the exposed database included employee and contractor account details for Stanford Health Care (SHC) and Hillsboro Medical Center (HMC). SHC is a prestigious hospital system affiliated with the Stanford University School of Medicine. HMC is a medical care facility located in Oregon.

Don't miss our latest stories on Google News. Add us as your Preferred Source on Google

Many businesses utilize MongoDB to handle large swaths of unstructured data. However, Perfectshift appears to be plagued by a common issue: databases are left unprotected without authentication, often due to human error.

“While it appeared that the data was imported to the database from encrypted sources, the data in the database was not encrypted or access-controlled,” our team explained.

The team responsibly disclosed the issue to Perfectshift in August. The company closed the exposed database in late October. We have reached out to Perfectshift for comment and will update the article once we receive an official reply.

What data was involved in the leak?

The exposed dataset contained over 50,000 records, which our team attributed to SHC and HMC. The database included information that corresponded to what a workforce management service provider would need, including:

Payroll data
Full names
Work email addresses
Hashed passwords
Browser agents
IP addresses
Session cookies
Authorization tokens

In theory, the data could become a gold mine for malicious actors. For one, exposed individuals are at increased risk of targeted phishing campaigns and social engineering attacks.

Threat actors are often drawn to targeting medical institutions due to the wealth of data they contain. Later, they can use it to exploit staff for scams and attempt to infiltrate medical systems, which are among the most sensitive to cyberattacks and downtime.

Data sample — Sample of the leaked data. Image from Cybernews.

“Employee accounts were at risk of takeovers, as it is possible to ‘dehash’ hashed passwords or hijack active sessions thanks to leaked internal authentication tokens,” our team explained.

The mix of authentication credentials and session data could enable persistent attackers to gain unauthorized access and use it for lateral movement within the network. That’s a prized possession among initial access brokers, who later sell it to ransomware gangs and other, often financially motivated attackers.

“Leaked passwords were hashed with bcrypt (cost 10), making it a significant challenge to try and guess the leaked passwords; likely only very motivated threat actors would try to 'crack' these passwords for potential future attacks,” the team explained.

The one silver lining is that researchers did not notice any patient data, or Protected Health Information (PHI), in the exposed dataset.

“The data leak highlights how vulnerable medical software can be. While there’s not too much to gain from hijacking employee accounts for these platforms, the leaked passwords, if dehashed, could lead to credential stuffing attacks,” the team said.

Next steps

The database is sensitive and should not be publicly accessible, as it contains PII and financial data of Stanford and Hillsboro Medical Centers’ employees
The owner should ensure that the database is no longer publicly accessible by enabling built-in authentication and authorisation features, employing IP whitelisting
Leaked credentials should be reset, and affected individuals and organizations informed

Third-party leak exposes Stanford Health Care staff details, passwords

What data was involved in the leak?

Next steps