Patient data was exposed through a wide open public S3 bucket.
How I discovered a public healthcare S3 bucket exposing patient records, verified the exposure safely, and delivered a responsible-disclosure report.
A multi-city hospital group had an AWS S3 bucket that was publicly accessible without authentication. The bucket exposed diagnostic reports, billing records, and personal information belonging to patients, employees, and doctors. I verified the exposure without downloading patient records and delivered a responsible-disclosure report with clear remediation steps.
The Problem
A multi-city hospital group had a patient portal where patients could download their diagnostic reports. The download button pointed directly to an AWS S3 URL without signed-URL protection. A quick check showed that the bucket was publicly listable, required no authentication, and contained medical and billing data that should never have been accessible from the open internet.
The problem was not limited to the portal itself. The storage behind the download links was exposed as a public S3 resource, meaning the normal access controls of the patient portal were not protecting the underlying files.
The Findings
The S3 bucket was publicly accessible without authentication in the ap-south-1 region. Directory listing was enabled, making the full object index visible through a normal browser. The files could also be downloaded anonymously using aws s3 cp --no-sign-request. There was no access logging or anomaly monitoring configured on the bucket either.
The Fix
I traced the S3 endpoint by inspecting where the patient portal's download button actually pointed. I then verified the public read permissions using aws s3 ls --no-sign-request.
I confirmed the scope of the exposure without downloading any patient records. For sensitive data, the goal is to prove the vulnerability while accessing as little real information as possible.
I then prepared a formal responsible-disclosure report covering the vulnerability, reproduction steps, evidence, and a prioritised remediation plan. The report referenced Indian IT Rules 2011, Article 21 of the Constitution of India, GDPR, and HIPAA equivalents.
The Result
The hospital group received a complete disclosure report containing evidence of the exposed bucket, clear reproduction steps, and a prioritised plan for remediation. The report was sent through the hospital group's contact channel as a professional courtesy.
No payment was taken for the work. The purpose was to give the internal security team enough evidence to understand the exposure, communicate its severity, and get the necessary fixes approved internally.