Michael Bazzell's new podcast discussed a client, who had a health portal. She did not actuallg have an account, but was able to create one under her information to sign up and then see ALL her health information the company had on her.
He later stresses to claim your account, so someone else cannot. Personally, I was given a health portal, and I asked them to deactivate it and they did. Of course that would mean that it's still active but only on the health practitioners end.
Now I am curious what you guys think about this? While I completely see and understand the idea of the health portal being active so it cannot be claimed by someone malicious, is it not also more likely to be vulnerable to a mass hack?
While currently, it would be on the health practitioner if that happenee, it seems as if it would be easier to gain access to an active account, versus an account that is not active except privately on the practitioners side?
Unless I'm overthinking it, and either way the third party company can get hacked and it will be exposed anyways.
So maybe it is better to claim the account?
Curious on anyones opinions and input.
Does your opinion change depending on threat model (more likely to be targeted vs not likely to be individually targeted but a mass company hack/data leak)
Here is the Podcast Episode if wanted for reference:
The Privacy, Security, & OSINT Show: 239-Health Portals, Vulnerability Reports, and Voice Cloning https://soundcloud.com/user-98066669/239-health-portals-vulnerability-reports-and-voice-cloning