> This is a wild exaggeration.

It isn't. I get that experience as a pentester can make you jaded to security practices, but the healthcare space is extremely regulated and much of what the grandparent said is a direct result of that.

> Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn't accessible to anyone who wasn't explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private.

This isn't just a minor misconfiguration. Again, this is a regulated space, with rules. There should be multiple layers in place to make sure that this is not opened to the public. There's risk assessments that needed to be carried out when the database was launched, and on a regular cadence afterwards. "It wasn't accessible to anyone who wasn't explicitly looking for it" isn't reassuring. Look at access logs on any device with a public IP address and it's clear that people are constantly looking.

> But no, you're not personally liable if a fuckup happens.

Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations.

> But you also take your job way too seriously. Bad.

People working in this space are required to have regular training and undergo audits of their activity, what information they access, risk assessments on how it is stored, and long, drawn out compliance activities just to get access.

>Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations.

Has anyone ever been actually sent to jail under HIPAA for something comparable to an honest DB config mistake? Has anyone been credibly threatened with it in the court of law? Has anyone come remotely close?

Not even close. The only case I could see it happening was if you purposefully exfiltrated data and sold it, or got some sort of personal gain out of it.

It's the same thing with PCI. They say you can go to jail for violations but exactly 0 people have ever been prosecuted, despite constant negligence in the payment industry.

Nope. Definitely not rank-and-file engineers.

Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then?

Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives.

Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be.

They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does.

But that doesn't change the fact that the world is insecure.

> Look at access logs on any device with a public IP address and it's clear that people are constantly looking

Yes, I'd be a bit surprised if this database hadn't already been detected by some automatic IP and port scanning scripts, and the wrong people found out about it

(I don't with exactly these things though do I might be mistaken)

Sorry you're the one wildly exaggerating about its importance. 2.5 million people wouldn't agree with your take on this. This stuff should never be public facing. It should be behind several layers of security not sitting on a public facing server without any protection. The people screwing this should be heavily fined and not be able to work on anything internet facing for several years while they have the time to learn a bit of network security if it does turn out to be gross incompetence/negligence.

If I understood correctly, the database was on a publicly accessible network. Wouldn't the problem be averted by putting the database in a separate VLAN, where only specific IP's from the public VLAN could access it, and not IP's from WWW??

You could secure it in a number of ways, including the way you mention. Unfortunately, it seems like security is no ones top concern unless they are forced to handle it correctly.

That's not really what VLANs are for, you'd probably just use firewall rules to restrict access to certain IPs. VLANs are more for creating virtual-networks-inside-networks, they're more organization-based than security-based.

What's more, it's important to take in the context of the data. It's not mental health, or HIV status, or sexual history, or really of any nature that can do damage other than the privacy aspect. It's people who hurt their neck after a car accident. Not the most sensitive stuff in the world.

Just to be explicit about it, I'm not suggesting the release of this data isn't a problem. Just that as medical data goes this is about an innocuous as it could have been. Even day-to-day visits to your primary care doc would probably have references to much more sensitive health data.

It's more sensitive than you'd think if any claims or settlements were involved. Or employers might want to snoop on their injured employees to find a reason to deny leave.