How the Data Leak Happened

• Sensitive reports and log exports were saved in a public or weakly secured cloud folder.

• Access was shared informally with external partners without expiry or tracking.

• Credentials and API keys appeared in plain text inside exports and screenshots.

• No DLP or classification policy prevented sensitive documents from leaving controlled locations.

Impact on Clinical Operations

• Exposure of ePHI and staff identifiers, increasing regulatory and legal risk.

• Higher likelihood of follow-on attacks (account takeover, lateral movement, phishing).

• Loss of trust from patients, partners and the Board if disclosure is required.

Controls to Prevent This

• Classify documents by sensitivity and enforce labels in M365 / cloud storage.

• Apply DLP policies that block or quarantine files containing ePHI or credentials.

• Use Just-In-Time sharing with automatic expiry and detailed access logs.

• Regularly scan cloud storage for exposed credentials, logs and misconfigured shares.

• Train staff on what “safe sharing” looks like and run periodic phishing / awareness tests.