This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Serviceaide, a provider of agentic AI-based IT management software, experienced a data breach involving a misconfigured Elasticsearch database used for its client, Catholic Health. The breach exposed the sensitive personal and medical information of over 483,000 patients for approximately seven weeks between September and November 2024. While no confirmed misuse of the data has been identified, the exposure of highly sensitive identifiers like Social Security numbers and medical records has prompted regulatory scrutiny and class action lawsuits.
An AI-linked platform operated by Serviceaide exposed sensitive health data from Catholic Health, affecting 483,000 patients. The breach stemmed from a misconfigured Elasticsearch database used in Serviceaide’s agentic AI infrastructure. Exposed information included medical records, insurance details, and login credentials. While no misuse has been confirmed, the nature of the data has prompted regulatory scrutiny and legal investigations.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The exposure resulted from an insecure direct object reference (IDOR) security vulnerability in the database configuration.
The incident involved the exposure of highly sensitive, non-public personal and medical information of over 483,000 patients due to a misconfigured database.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data exposure was caused by a human misconfiguration (IDOR) of an Elasticsearch database post-deployment, which was unintentional.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
An IT vendor's database misconfiguration exposed the sensitive personal and medical data of over 483,000 Catholic Health patients. While healthcare is critical infrastructure, the incident was a passive data exposure with no operational disruption, physical harm, or active exploitation detected, representing a minor national security impact.
The reports identify Serviceaide as a provider of agentic AI-based IT management software, but the incident itself is a database misconfiguration (IDOR) and does not describe any active behavior, decisions, or operations executed by the AI system.
Limited Risk: The reports describe Serviceaide as providing 'AI-driven chatbots and IT support solutions', which falls under the category of chatbots requiring transparency obligations.
The reports describe Serviceaide as a provider of AI-driven chatbots and IT support/workflow management solutions, though the AI's specific operational goals are secondary to the database misconfiguration that caused the incident.
The reports provide consistent and detailed information regarding the nature of the data breach, the timeline of exposure (September 19 to November 5, 2024), the specific types of sensitive data exposed, and the exact number of affected individuals (483,126). There is high agreement across multiple sources regarding the cause (Elasticsearch database misconfiguration/IDOR) and the lack of immediate evidence of data exfiltration.
None. The event is clearly a data exposure incident due to IT misconfiguration.
Technology
Insecure Database Configuration
Elasticsearch database was left publicly accessible without authentication.
IDOR Misconfiguration
Insecure direct object reference allowed unauthorized access to data.
Lack of Database Monitoring
Absence of real-time monitoring tools delayed detection of the exposure.
Data Inputs
Unsecured Sensitive Health Data
Patient records and psychiatric notes were stored in an unencrypted format.
Credential Exposure in Database
Database contained unhashed or vulnerable email usernames and passwords.
Structured Data Storage Format
Structured format in Elasticsearch allowed rapid querying and exporting.
Human Factors
Configuration Oversight
IT staff inadvertently made the Elasticsearch database publicly available.
Overreliance on Third-Party
Catholic Health assumed the vendor's security protocols were sufficient.
Process and Methods
Delayed Incident Detection
The database remained exposed for 47 days before being discovered.
Slow Breach Notification
Serviceaide delayed notifying affected individuals for seven months.
Inadequate Vendor Auditing
Catholic Health failed to proactively audit Serviceaide's security practices.
Management
Inadequate Vendor Risk Management
Lack of operational oversight in third-party vendor relationships.
Underfunded Cybersecurity Budget
Healthcare leaders failed to allocate sufficient budget to patient data safety.
Regulatory Environment
Evolving Regulatory Requirements
Complex HIPAA and 42 CFR Part 2 rules slowed down the impact assessment.
Weak Vendor Compliance Rules
Existing guidelines did not mandate biannual vendor security validations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
