---
title: How I Found 21,000 Patient Photos Online—And What Happened Next
date: 2026-06-22
category: Security
cover: /blog-images/patient-images.webp
coverAlt: "A medical records folder holding patient photo cards secured by a small padlock, beside an open door spilling light into a dark room"
excerpt: How a routine scan uncovered 21,000 exposed patient images — and what responsible disclosure looks like in practice.
---

## The Open Door

It was a routine scan. I was exploring subdomains when I stumbled upon a data‑labeling portal for a European telemedicine company. The login page had a "Sign Up" button. I clicked it.

No email verification. No access code. No approval. Just a form. Thirty seconds later, I was in.

The dashboard loaded. Rows of projects with clinical names: "Skin Condition Segmentation," "Bodyparts," "T‑Zones." I clicked one. Thumbnails appeared—high‑resolution medical photographs of skin lesions, rashes, moles. Each image was tagged with a clear‑text diagnosis: "hand eczema," "actinic keratosis," "psoriasis."

My stomach dropped. This wasn't a test environment. This was live patient data.

## The Scope

A quick manual review revealed the scale:

- Over 21,000 medical images of patients' skin.
- More than 22,000 physician annotations containing diagnoses.
- Internal case IDs that could link back to full medical records.
- A full user list, including employees and external contractors.

The software was years out of date. Even more alarming: the project list contained SQL injection payloads as project titles—signs that an automated attack tool had already been there. Someone else had found this door before me.

## The Report

I drafted an urgent email. Subject: "CRITICAL SECURITY FLAW." I outlined the immediate steps: disable open registration, lock suspicious accounts, notify the data protection authority within the 72‑hour GDPR window. I was clear about my actions: I had accessed the system with a test account to confirm the vulnerability. I had not downloaded patient images. I had not attempted to identify individuals. I provided the test account details and asked for its deletion.

Then I sent it.

## The Response

Within hours, I had a reply. The company's data protection lead acknowledged the report. The vulnerable system was taken offline immediately. A forensic investigation was launched.

Then came the surprise: they offered a bounty for a full technical report.

We agreed on a fee. The payment arrived promptly. I delivered a detailed breakdown of the vulnerability, along with a dozen other security issues I'd identified across their infrastructure—exposed admin panels, leaked API keys, misconfigured services.

## The Professional Dialogue

A day later, they followed up with a clarification request about data access. We exchanged emails, clarified the scope of what was viewed versus what was retained, and reached a mutual understanding. The tone remained professional, focused on resolution. They thanked me for my cooperation. The matter was closed.

## Why This Story Isn't a Horror Story

**Responsible disclosure works.** When a company responds with urgency and respect, the vulnerability gets fixed, patients are protected, and researchers are incentivized to report, not exploit.

**Bounties build bridges.** A fair bounty transforms a security report into a legitimate transaction. It compensates the researcher and delivers critical intelligence to the company.

**"Shadow IT" is a silent risk.** This labeling tool was likely set up for an internal project and forgotten. Without lifecycle management, such systems become open doors to sensitive data.

**Transparency is the best policy.** My detailed report gave them what they needed to act. Their transparent communication prevented the situation from becoming adversarial.

## The Takeaway

Finding a data leak of this scale is a mix of dread and duty. What you do next defines the outcome. I chose to report it responsibly. The company chose to listen, fix the issue, and pay for the insight. No lawsuits. No public shaming. Just a security flaw patched and a safer system for patients.

That's how security should work. And that's a story worth sharing.