According to CVS Health, the metadata did not contain any personally identifiable information, and there was no risk to patients, customers or members. WHY IT MATTERS However, the researchers noted that the records contained email addresses – which could conceivably identify a person’s first or last name. They pointed out, for example, that a Google search for some of the exposed email addresses enabled them to identify the email’s operator.
“We immediately investigated and determined that the database, which was hosted by a third-party vendor, did not contain any personally identifiable information of our customers, members or patients,” according to the statement. “In March of this year, a security researcher notified us of a publicly accessible database that contained non-identifiable CVS Health metadata,” said CVS Health in a statement sent to Healthcare IT News.
“We’ve addressed the issue with the vendor to prevent a recurrence and we thank the researcher who notified us about this matter.” Public access to the data was restricted the same day that CVS Health was notified.
Fowler says CVS Health told him that the emails were not from customer account records. Rather, they were entered into the search bar, which captures and logs everything that is entered into the website’s search function, by visitors themselves – likely in a mistaken attempt to log in to their account using the wrong field. “This could explain how so many email addresses ended up in a database of product searches that was not intended to identify the visitor,” said Fowler. CVS Health did not respond to follow-up questions about this potential connection.
“Hypothetically, it could have been possible to match the Session ID with what they searched for or added to the shopping cart during that session and then try to identify the customer using the exposed emails,” wrote Fowler in his blog post. The records also contained a “visitor ID” and “session ID.”
The News Highlights
- More than 1 billion CVS health records exposed in the online database
- Check the latest Health news updates and information about health.
For Latest News Follow us on Google News
- Show all
- Trending News
- Popular By week