Apollo Hospitals: patient records and live keys in a public archive
A zip file on a public Apollo subsidiary website held patient reports, ID documents, full source code, database backups, and live credentials for payment and SMS gateways.
- Target
- Apollo Hospitals subsidiary website
- Bug class
- Exposed backup, credential leak
- Data at risk
- Patient reports, ID documents, credentials, source code
- Reported to
- Apollo, then CERT-In and NCIIPC
- Status
- Archive removed; no fix confirmed by Apollo
- Researchers
- Akshay CS and Viral Vaghela
What was the issue
A zip archive was downloadable from one of Apollo Hospitals' subsidiary websites. Anyone who found the link could download it, with no login required.
What was inside
- Identity documents: staff work IDs, PAN and Aadhaar cards, passports, student IDs
- Patient medical reports and vaccination details
- Credentials for the payment gateway, SMS gateway, system email, databases, CRM, and third-party services
- Complete backend and frontend source code, system and database backups, and web firewall configuration
- Resumes of doctors and other job applicants
More weaknesses
Alongside the archive, the researchers reported SQL injection flaws, signs of reverse shells on the servers, weak authentication, and internal links that were publicly reachable, some showing live patient and hospital data.
It is unclear whether Apollo or an attacker created the archive. The researchers believe it may be linked to the KillSec ransomware group, which threat intelligence firm Halcyon reported had attacked Apollo in October 2024.
Disclosure timeline
Archive found on a subsidiary website.
Reported to Apollo's management.
Archive removed, with no response to the researchers.
A second, smaller archive appears. Escalated to CERT-In and NCIIPC.
Decode publishes the investigation. Apollo had not responded.
The takeaway. Backups and build artifacts on a web server are public until proven otherwise. Keep secrets out of archives and rotate any credential that has ever been exposed.
