Patients’ personal data, including health data, was downloaded from the information system that Innovaatik runs for dental care providers. Initial estimates say data from more than 300 Estonian healthcare providers is affected. The clinics’ own computers were not the source: the data sat in a system their supplier manages.
What happened?
At the end of August, Innovaatik told the police that the system it manages had been accessed illegally and repeatedly, and that patient data had been downloaded. According to ERR, the data included personal identification codes, email addresses and health data. Most of it concerns dental treatment, but it may include other medical history.
On Wednesday, 2 September, the Central Criminal Police detained a 45-year-old Estonian citizen who had a previous connection to the company. Police suspect he had been accessing the database since the end of June. The police’s preliminary assessment is that his motive may have been to draw attention to security weaknesses in the system.
He is a suspect, and only a court can decide guilt. Prosecutors say there is currently no reason to believe he passed the data on or made copies of it, and that the downloaded data has been recovered. The number of patients affected will be established in the criminal proceedings.
Police also warn about follow-up scams. Anyone who demands money in connection with the leaked data is, in their words, probably a fraudster.
Why does this matter beyond dentistry?
Many small businesses no longer keep customer data on their own server. Bookings, accounting, the online shop and the customer list often live in a supplier’s cloud service. If something goes wrong in that system, your customers’ data can leak even though you did nothing wrong yourself.
Your responsibility to those customers stays with you. Under the GDPR, the business that collects the data is normally the controller and the software supplier is the processor. A processor must tell the controller about a breach without undue delay. The controller must then notify the Data Protection Inspectorate (AKI) within 72 hours of becoming aware of it.
What should you ask your software supplier?
How the suspect got into the system has not been made public, so this case says nothing certain about the cause. It is still a good prompt to put a few questions to your own suppliers:
- How is access removed for former staff and contractors? Ask how quickly that happens after someone leaves.
- Is it logged who views and downloads our data? Ask whether anyone reviews the logs and whether a large download would be noticed.
- How fast will you tell us about a breach? Put a deadline in the contract so that you can still meet your own 72 hours.
- Is two-step login required? Ask about both the supplier’s staff and your own users.
- What data is kept, and for how long? Data that is not stored cannot leak.
What to do if a leak affects your customers
- Ask the supplier in writing whether the breach involves your data, and which kinds.
- Notify AKI within 72 hours of becoming aware of the breach, if it may put people’s rights and freedoms at risk, using the form on AKI’s website. The GDPR allows you to send information in stages if not everything is known yet.
- Inform the people affected if the breach is likely to pose a high risk to their rights and freedoms.
- Warn customers about scams. Tell them that anyone demanding money over leaked data is most likely a fraudster.
- Write down what happened, what you decided and why. Breaches must be documented even when AKI does not need to be notified.
If you need help handling a breach, see our incident help page.
Sources
- ERR News: Patient health data leaked from dentists' information system
- ERR: Hambaarstide infosüsteemist lekkisid patsientide terviseandmed
- Postimees: Suur andmeleke. Politsei kahtlustab meest hambaravi patsientide andmete varastamises
- Estonian Data Protection Inspectorate: Breach notification
- EUR-Lex: General Data Protection Regulation (EU) 2016/679
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
