Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Over 8 Million COVID-19 Test Results Leaked Online

Over 8 Million COVID-19 Test Results Leaked Online

Millions of COVID-19 test reports were found to be publicly accessible due to flawed online system implementation.

The leak, comprising over 8 million COVID-19 test results, has been attributed to the Health and Welfare Department of West Bengal, India.

Researcher spots millions of COVID test results leaking online

Last month, BleepingComputer exclusively reported that multiple Indian government websites were leaking COVID-19 patient test reports.

This week, security researcher Sourajeet Majumder has shared with BleepingComputer his discovery of another government website exposing millions of COVID-19 test results.

“I have found an issue in an Indian Government site which is resulting in the leakage of test reports of EVERYONE who took a COVID-19 test in a particular state.”

“These reports have sensitive information about the citizens in them like name, age, date and time of sample testing, residence address, etc,” Majumder told BleepingComputer.

The state the researcher refers to is the Indian state of West Bengal.

At the time of his original discovery, the researcher suspected the number of publicly accessible reports was crossing the 8 million mark, based on the daily bulletin published by the government.

Majumder spotted the leakage on seeing the contents of a text message sent to a COVID-19 test taker.

The structure of the URL in the text leading to the result comprised a base64-encoded report’s ID number (“SRF ID”) as shown below.

Also Read: 10 Practical Benefits of Managed IT Services

Text message seen by the researcher which had a link to COVID-19 test result
Source: BleepingComputer

As confirmed by BleepingComputer, the base64-encoded report number could be decoded to a simpler numeric form, incremented/decremented to construct new sets of URLs that would enable accessing other patients’ COVID-19 test results.

Majumder noticed that the base64 encoding applied to the numeric identifier was optional, and stripping it away had no impact on the ability to retrieve the reports. 

In this manner, the researcher demonstrated to BleepingComputer that an attacker could retrieve COVID-19 test results of millions of patients by simply enumerating the URLs:[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX1[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX2[.]in:8003/Covid19.aspx?SRFID=1931XXXXXX3

Every report revealed the patient’s name, age, gender, partial home address, COVID-19 test result, date of the test, report identifier, and details pertaining to the location of the testing lab.

COVID-19 test report india
One of the COVID-19 test reports obtained by the researcher
Source: BleepingComputer​

Health department fixes the leak

On seeing the leaky endpoint was hosted on domain, BleepingComputer reached out to the relevant IT contacts at West Bengal’s Health and Welfare department.

Additionally, the researcher had told BleepingComputer that he had attempted to make contact with the relevant parties beforehand.

Although BleepingComputer did not hear back from the contacted personnel, the issue has been remediated.

The URL endpoints previously leaking the COVID-19 reports now return a 404 (not found) message, as seen by BleepingComputer.

Dr. Sushant Roy, a government-appointed health official tasked with overseeing the COVID-19 situation in North Bengal has also acknowledged the leak.

In a statement made to a regional news outlet, Dr. Roy said that information such as the COVID-19 test result data is meant to be kept confidential especially to safeguard the privacy of COVID-19 patients. He continued that the government only provides such information to the patient’s family members.

Dr. Roy expressed surprise at the system flaw that made it possible to access anyone’s test report and stated that immediate action will be taken to rectify the problem.

This is not the first time COVID-19 test results have been spotted leaking online at such a scale.

Previously, multiple independent labs were leaking patient test results due to a flawed QR code implementation that could let threat actors enumerate the test result URLs.

Also Read: What Legislation Exists in Singapore Regarding Data Protection and Security?

When generating publicly accessible URLs, it is probably a good idea to include some unguessable or randomized bits of data to them so as to make enumeration challenging.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us