Synthetic tenant: Kestrova Health (fictional), 442 receipts. Sixty days of activity are generated deterministically and anchored to the current hour, so expiry and breach clocks are live. Every receipt is signed at load with Ed25519 key ksv-47c7d4987f3a and re-verified by the same code the public verify API runs. Consents you sign in the patient journeys appear at the top of the registry, held only in your browser.
INC-2026-027: Lab-report portal storage exposed
Kestrova Gachibowli · became aware 12 Oct 2026, 6:30 am IST · about 412 people
A storage bucket behind the lab-report portal was publicly accessible for 6 hours after a deployment. Access logs show 9 anonymous read requests across 412 reports. Data exposed: patient name, date of birth, lab results.
The four clocks
Report to CERT-In
CERT-In Directions, 28 Apr 2022: within 6 hours
Done 12 Oct, 10:30 am
Initial intimation to the Board
DPDP Rule 7(2)(a): without delay. Internal target 24h
Done 12 Oct, 1:30 pm
Intimation to each affected patient
DPDP Rule 7(1): without delay. Internal target 48h
Done 13 Oct, 12:30 pm
Detailed report to the Board
DPDP Rule 7(2)(b): within 72 hours
Done 14 Oct, 7:30 pm
Rule-matrix triage
- Severity
- medium
- Board intimation
- Required (every breach)
- Patient intimation
- Required (every breach)
- CERT-In
- Likely reportable
Deterministic rule matrix. Exposure vector: unauthorised access or credential compromise (matched "read requests"). Scale: 412 parsed from the text. Severity = vector 2 + scale 0 points = MEDIUM. Board and patient intimation are not scored: DPDP requires both for every personal data breach. Factor coverage 100% is how many of the three matrix inputs the text supplied, not a confidence score.
AI second opinion
Advisory only. A model reads the incident; its answer is validated, then set beside the matrix. The matrix decides severity and no model decides a legal duty.
Immediate actions
- highContain: isolate affected systems and revoke exposed credentials · CISO
- highReport to CERT-In within 6 hours of noticing the incident · CISO
- highIntimate the Data Protection Board without delay: nature, extent, timing, location, likely impact (Rule 7(2)(a)) · DPO
- highIntimate each affected patient without delay, in plain language and their language (Rule 7(1)) · DPO
- mediumFile the detailed report with the Board within 72 hours: causes, mitigation, remediation, patient intimations (Rule 7(2)(b)) · DPO
Drafts for DPO review
The hospital name, contact and triage come from the server. Drafts are never sent; filing and sending are out of scope here.
Initial intimation to the Board
Notice to affected patients
Closure record
Findings: Bucket policy regressed in a deployment template. The 9 reads came from 2 IP addresses; no bulk download pattern.
Change made: Storage policy is now checked in the deployment pipeline; public-read on any bucket fails the build.