Gladney Centre for Adoption leaks 1.1 Million sensitive records
Learn More
Cybersecurity researcher Jeremiah Fowler discovered an unencrypted and non-password-protected database containing 1,115,061 records associated with the Gladney Centre for Adoption, a Texas-based adoption agency.
The database, 2.49 GB in size, was publicly accessible without any password protection. Fowler immediately sent a responsible disclosure notice to Gladney Centre for Adoption, and the database was restricted from public access the following day. The organization did not respond to the disclosure notice, and it remains unknown whether the database was managed directly by Gladney or by a third-party contractor.
Exposed data inlcudes:
- Names of children involved in adoption processes
- Birth parent names, including first, last, and middle names
- Adoptive parent names and contact information
- Physical addresses and geographic locations
- Email addresses and phone numbers
- Employee records with names, email addresses, and dates modified
- Internal case notes detailing grounds for denial or approval of adoptive parents
- References to substance use and legal issues affecting applicants
- Birth father details including family circumstances and legal issues
- Child Protective Services (CPS) children records
- Pregnancy information and birth details
- Medical expenses and health-related information
- Dorm resident information
- Lead generation and outreach data
- Email subject lines and sender information (284,000 records)
- Application records with internal notes (39,000 records)
The database contained 1,115,061 records but it's not clear how many individuals were affected by these records, since multiple records may pertain to the same adoption and the database contained multiple record types and potential duplicates. Even if 10 records pertain to one adoption that's at least 100,000 individuals.
The duration of the database exposure before discovery is not clear. It'z not known if unauthorized parties accessed the data prior to its removal.
