Adoption agency data exposure reveals information about children and parents
The adoption process is sensitive in nature and involves profound personal information about children, biological parents, adoptive parents and other caregivers. So he was immediately concerned when long-term data breakthrough hunter and security researcher Jeremiah Fowler visited a publicly accessible database online in late June that seemed to contain information related to adoption.
Fowler scrambled to identify the owner of the database and concluded that it was a nonprofit Gladney adoption center in Texas, mainly located in Texas. He then worked hard to notify the organization of the June 25 exposure data, but received no response. He tried again on June 26 and silently secured the database for hours, hoping before anyone else could access it.
Even after years of hard work to raise awareness of the problem, it can also make the people you meet access to information, which is very common online. Fowler was particularly shocked to see data related to adoption, though, as Trove included details such as the identity of some children’s biological parents, data on personal medical and mental health status, information on interactions with child protection services, and even records referring to court orders. The database also includes more typical personally identifiable information such as name, address, telephone number, email address and unique identifier assigned to a child case. Fowler was eventually able to trace the database back to Gladney, as it also contains information about certain employees of the organization.
“This is the first time I’ve seen data adoption in all my studies because a lot of these kids are very vulnerable,” Fowler told Wired. “I believe the data was exposed during the transfer to another system and it has been going on for a few days before I found it. So I went to bed at night and hope I could master it before the bad guys.”
Fowler said the data appears to come from a customer relationship management or CRM system used to organize customer data in businesses and other organizations. Trove contains over 1.1 million records at 2.49 GB.
“The Gladney Adoption Center takes security seriously. We always conduct detailed investigations on any incidents with the assistance of external information technology experts. Data integrity and operations are our top priority,” Chief Operating Officer Lisa Schuessler wrote in a statement. “In any incident, we work with law enforcement to comply with applicable laws and regulations and inform all affected persons if it is determined that the sensitive information possessed is affected.”
When asked whether it should be considered as confirming that Gladney ensured the exposed database Fowler discovered and notified individuals including the data contained, Schuessler mentioned Gladney’s initial response. The statement also noted that Gladney “continuously takes other steps to further strengthen and strengthen our systems to ensure that our network and the information entrusted to us are secure.”
