Saitama Citizens Medical Center: patient photos and staff data exposed through staff-page attachments

Attachments on staff-only pages could be accessed directly without the intended permissions. A Center Manual uploaded on 20 July 2018 contained 2 patient photos and names/phone numbers of 2 staff members. Specific operations could show the patient photos before processing. The image count does not establish the patient count or the total number of people affected. [1]

As of the 28 September notice, no resulting harm was confirmed and actual third-party acquisition was not established. The notice gives neither a remediation completion date nor the date unintended access became possible. This is separate from the lost surgical-image media disclosed on 6 October. [1]