“2-Year Delay in Public Disclosure of COVID-19 Vaccination Records Due to Irish Government Website Glitch”

A bug in an Irish government website that exposed COVID-19 vaccination records took two years to publicly discloseThe Irish government fixed a vulnerability two years ago in its national COVID-19 vaccination portal that exposed the vaccination records of around a million residents. But details of the vulnerability weren’t revealed until this week after attempts to coordinate public disclosure with the government agency stalled and ended. Security researcher Aaron Costello said he discovered the vulnerability in the COVID-19 vaccination portal run by the Irish Health Service Executive (HSE) in December 2021, a year after mass vaccinations against COVID-19 began in Ireland. Costello’s public disclosure marks more than two years since first reporting the vulnerability. His blog post included a multi-year timeline revealing a back and forth between various government departments that were unwilling to take claim to public disclosure.

A security researcher recently revealed that a bug in an Irish government website compromised sensitive COVID-19 vaccination records for nearly a million residents. The vulnerability, which was discovered in December 2021, took two years to be publicly disclosed due to delays in coordinating with the government agency responsible for the site.

The researcher, Aaron Costello, who specializes in securing Salesforce systems, discovered the flaw in the COVID-19 vaccination portal operated by the Irish Health Service Executive (HSE). The portal, built on Salesforce’s health cloud, allowed any member of the public to access the vaccination records of other users who had registered with the portal.

According to Costello, over a million Irish residents’ records were exposed, including their full names, vaccination details, and internal HSE documents. However, Costello noted that the bug was not immediately apparent to regular users of the site, as it required specific actions to access the sensitive information.

The HSE has confirmed that Costello was the only person to report the vulnerability and that there is no evidence of unauthorized access to the compromised data. The agency also stated that they addressed the issue on the same day it was reported, and the data accessed was not enough to identify any individuals.

Under the European Union’s GDPR regulations, Ireland is subject to strict data protection laws. However, organizations are not required to publicly disclose vulnerabilities that have not resulted in a mass theft or access of sensitive data. In this case, the HSE determined that a personal data breach report was not necessary.

Even though there is no legal obligation to disclose the bug, Costello has reached out to various government departments for over two years to coordinate a public disclosure. He was ultimately told that the government would not reveal the vulnerability to the public, claiming that it did not exist.

This incident highlights the importance of sharing knowledge and experiences in the security community to prevent similar exposures at other organizations. While organizations may not have a legal requirement to disclose vulnerabilities, public disclosure can help prevent future security incidents and protect users’ sensitive data.

Avatar photo
Kira Kim

Kira Kim is a science journalist with a background in biology and a passion for environmental issues. She is known for her clear and concise writing, as well as her ability to bring complex scientific concepts to life for a general audience.

Articles: 823

Leave a Reply

Your email address will not be published. Required fields are marked *