Incident 1070: La plateforme d'IA Serviceaide impliquée dans l'exposition de données de santé affectant 483 000 patients de Catholic Health
Répondu
Description: Une plateforme d'IA exploitée par Serviceaide a exposé des données de santé sensibles de Catholic Health, affectant 483 000 patients. La faille provenait d'une base de données Elasticsearch mal configurée, utilisée dans l'infrastructure d'IA agentique de Serviceaide. Les informations exposées comprenaient des dossiers médicaux, des informations d'assurance et des identifiants de connexion. Bien qu'aucune utilisation abusive n'ait été confirmée, la nature des données a donné lieu à un examen réglementaire et à des enquêtes judiciaires.
Editor Notes: Timeline notes: According to the company's notice (which can be accessed at https://www.serviceaide.com/notices) and third-party reporting, Serviceaide discovered the inadvertent exposure of Catholic Health's Elasticsearch database on November 15, 2024. The exposed data was accessible between September 19 and November 5, 2024. Serviceaide reported the breach to the U.S. Department of Health and Human Services on May 9, 2025 (which is being taken as the incident date for this incident ID), following a months-long investigation and data review. Public disclosure and notification to affected individuals began shortly thereafter.
Entités
Voir toutes les entitésPrésumé : Un système d'IA développé et mis en œuvre par Serviceaide , Serviceaide agentic AI platform , Elasticsearch database et Enterprise AI systems, a endommagé Privacy , Patients of Catholic Health , Patients et Catholic Health.
Systèmes d'IA présumés impliqués: Serviceaide agentic AI platform , Elasticsearch database et Enterprise AI systems
Statistiques d'incidents
Risk Subdomain
A further 24 subdomains create an accessible and understandable classification of hazards and harms associated with AI
2.1. Compromise of privacy by obtaining, leaking or correctly inferring sensitive information
Risk Domain
The Domain Taxonomy of AI Risks classifies risks into seven AI risk domains: (1) Discrimination & toxicity, (2) Privacy & security, (3) Misinformation, (4) Malicious actors & misuse, (5) Human-computer interaction, (6) Socioeconomic & environmental harms, and (7) AI system safety, failures & limitations.
- Privacy & Security
Entity
Which, if any, entity is presented as the main cause of the risk
AI
Timing
The stage in the AI lifecycle at which the risk is presented as occurring
Post-deployment
Intent
Whether the risk is presented as occurring as an expected or unexpected outcome from pursuing a goal
Unintentional