West Tallinn Central Hospital Data Breach via USB Media
Learn More
West Tallinn Central Hospital (LTKH) in Estonia reports a data leak through the unauthorized disclosure of patient health information via physical media. The incident occurred when a patient, after undergoing X-ray imaging, received a USB drive from the hospital that contained not only their own records but also the medical data of multiple other individuals.
While the hospital claims to use fresh media, the patient discovered files dating back to 2019 when reviewing the drive at home. This suggests either the reuse of improperly sanitized storage devices or a systemic error in the imaging software that bundled multiple patient records into a single export session. The hospital has not yet identified the specific technical or human error responsible for the data mix-up. The compromised data includes:
- Full names
- Personal identification codes
- Medical histories
- Procedure dates and descriptions
- X-ray images and anatomical details
The number of affected individuals is not disclosed. The Estonian Data Protection Inspectorate (AKI) characterized the event as a breach of personal data protection requirements.
Patients who receive medical data on physical media should verify the contents immediately and report any extraneous files to the provider and relevant data protection authorities.
