HDDs with medical records of Dutch residents end up at a flea market

Although flea markets usually sell almost useless items, sometimes you can find real treasures there. For example, an electronics enthusiast from the Netherlands acquired a “bundle” of old HDDs containing gigabytes of confidential medical records, The Register reports.

Robert Polet bought five hard drives for €5 ($5.21) each at a flea market near one of the local air bases. According to Omroep Brabant, Polet has been an IT enthusiast and an avid photographer for over 30 years (which is what prompted him to buy the HDDs), although he works as a driver. On the purchased drives, Polet found medical records of his fellow citizens, including social security numbers, dates of birth, home addresses, information about prescribed medications, doctors and pharmacies. The records were made between 2011 and 2019 and mainly concerned people from the cities of Utrecht, Houten and Delft. So Polet returned to the market and bought the remaining ten HDDs from the same seller.

Image source: William Warby / Unsplash

Polet examined only two of the fifteen HDDs, but that was enough to conclude that the leak concerned a local medical organization. Apparently, it was the bankrupt Nortade ICT Solutions, which developed software for the healthcare sector. As experts note, the software developer has no right to store such information at all. But even if it fell under some exception to the law, all data must still be encrypted, and the drives must be properly disposed of when decommissioned. Dutch laws require that medical data be removed from drives by professionals (somewhere this is put on stream), and the removal process itself must be certified.

Security incidents related to improper disposal of e-waste happen regularly. For example, in the summer of 2023, it was reported that an SSD with confidential data was stolen from an SAP data center, and this was the fifth such incident in two years, and one of the drives appeared on Ebay. Morgan Stanley once saved $100,000 on the disposal of hard drives, and as a result lost $120 million.