The Photo That Revealed Too Much
Lena is a support agent at a small healthcare clinic. She posts a cheerful photo on her personal social media showing her new desk, with a monitor in the background displaying a patient's appointment list and a sticky note with the clinic's shared admin password. Her profile is public. A colleague sees it and warns her. The post has been up for six hours and has 40 likes, two shares. The clinic uses one shared admin account for the booking system, and staff sometimes reuse that password for other tools.
1. Identify what has been exposed and why each item matters.
Read the worked answer
Exposed items:
- Patient appointment data on screen - personal health information, visible to the public. This is the most serious item because it concerns other people who did not consent.
- Shared admin password on the sticky note - anyone who saw the photo can now access the booking system, and because the password is reused, possibly other tools.
- Workplace and role details - useful to an attacker for future targeted phishing ('I'm calling from the clinic IT team').
The post being public and shared means deletion does not undo exposure - assume it was seen and copied.
2. What should Lena and the clinic do, in order?
Read the worked answer
Order matters - contain first, then investigate.
- Delete the post and ask the colleague who shared it to remove it (limited value, but reduces spread).
- Rotate the shared admin password immediately and check for reuse elsewhere.
- Review access logs for the booking system for the six-hour window.
- Report the incident internally; assess whether patient-data exposure requires notification.
- Replace the shared account with individual logins so actions are attributable.
Reasoning: the password is the fastest route to further harm, so it is rotated before anything else is investigated.
3. The clinic manager says 'it was just a photo, no harm done'. Construct the counter-argument.
Read the worked answer
Counter-argument:
- The harm is potential, not proven - absence of evidence of misuse in six hours is not evidence of safety.
- The data belonged to patients, who have a right to confidentiality regardless of outcome.
- The shared password was visible, and reuse means the blast radius is unknown.
- The root cause - shared credentials and no policy on posting - will recur.
So the correct stance is: treat it as a reportable incident, fix the credentials, and add a simple social-media and password policy. 'No harm done' is a conclusion that can only be reached after checking logs, not before.