Authorities in a northern Indian state (name not yet revealed) uploaded an enormous database of pregnancy-related sensitive records on to a server, connected it to the internet, and left it open without any password protection. The database involves over 12.5 million records, including pregnancy details, abortion and diagnosis reports, reports of ultrasonography, amniocentesis and genetic examination of the fetus. Details of name, age, residential address, family information and contact numbers of all the individuals involved are also there in the records. The database also contains emails, complaints and conversations regarding illegal prenatal gender determination.

Bob Diachenko, a cyber security researcher, came across this information during a regular security check on a public search engine.

This could mean leakage of a huge amount of personal data, imprisonment of several parties involved due to violation of legal code, cyber attacks and blackmail of families who would never even think that their data would be stolen from a government server.

Diachenko, who works actively to secure data and servers that fail to protect sensitive personal data, said that leaving such sensitive information inside a password-less server is similar to breaking doctor-patient confidentiality.

He mentioned that India has always been a focus in his researches and several of his reports covered data breaches from India-based companies. He added that outdated software might cause troubles. But greater troubles arise from inadequate cyber hygiene, like disabling passwords.

With public configuration, cyber-criminals can manage the whole system with full administrative privileges, he mentioned. He further stated that there are many people who are on the lookout for open/exposed servers, but not for responsible disclosure. They delete the data or download it and then sell or use it for malicious activity.