ESHYFT Cybersecurity Incident Investigation

Recently, it was reported by an online source that ESHYFT had experienced a cybersecurity incident impacting the privacy of its data. According to this source, a cybersecurity researcher discovered a non-password-protected database that contained thousands of records belonging to ESHYFT.¹ The exposed database contained 86,341 records totaling 108.8 GB in size.¹ The majority of the documents were contained inside of a folder labeled “App”.¹ In a limited sampling of the exposed documents, the researcher noticed records that included profile or facial images of users, .csv files with monthly work schedule logs, professional certificates, work assignment agreements, CVs and resumes that contained additional personal identifiable information.¹ One single spreadsheet document contained 800,000+ entries that detailed a nurse’s internal IDs, facility name, time and date of shifts, hours worked, and more.¹ Additionally, the database contained what appeared to be medical documents uploaded to the app potentially proof for why individual nurses missed shifts or took sick leave.¹ These medical documents included medical reports containing information of diagnosis, prescriptions, or treatments that could potentially fall under the ambit of HIPAA regulations.¹ The name of the database as well as the documents inside it indicated that the records belonged to ESHYFT.¹

According to the source, after discovering the database the researcher notified ESHYFT of the exposure. In response, ESHYFT thanked the researcher saying, “Thank you! we’re actively looking into this and working on a solution”.¹ At this time, it is not known how long these documents were exposed to the public or if anyone else may have accessed the database.¹ As of March 18, 2025, ESHYFT has not publicly acknowledged the data exposure or confirmed whether the incident resulted in a data breach.