We publish every incident involving a customer, including the ones that make us look slow. This one started with an export link created for a vendor and ended with a product change. It is shared with the customer's permission; the customer is a regional hospital network.
The timeline is short. A compliance analyst created an export of patient records for an external auditor and shared it through a link. The link was set to require sign-in, which it did. It was not set to expire, because the default was no expiry. Eleven months later the auditor's firm reported a phishing incident; the compromised mailbox contained the link, and the link still worked for anyone who could sign in to the firm's identity provider.
The attacker never opened anything; the Identity Hub logged every open of the link, and the only opens were the auditor's in the first week. That is the good news, and it is also luck. A link that keeps working for eleven months is an incident waiting for a worse day.
We made three changes. Export links now expire after seven days by default and the maximum is ninety; the Entitlement Engine refuses a longer value. Second, every link lists its opens on the owner's dashboard, so a link that is still live after the work is done is visible to the person who made it. Third, a link to patient records that has not been opened in thirty days is revoked automatically and the owner is told.
The lesson about process was about defaults. The expiry option existed, documented and tested. Options are not controls; defaults are. Every setting in Privr that widens exposure now starts at the restrictive value, and loosening it is a recorded decision with an owner, which is what the HIPAA auditors ask to see anyway.
We also changed how we review features. Each new sharing capability now goes through a short exercise: assume the recipient's account is compromised a year from now; what does the attacker get? If the answer is anything, the default is wrong.
Our incident write-ups are collected on this blog and summarized in the quarterly transparency report. Ask us for the report if you are evaluating Privr.