Serviceaide, Inc., a California-based provider of AI-driven IT management software, has reported a major data security incident that inadvertently exposed the sensitive personal and protected health information (PHI) of over 483,000 patients of its client, Catholic Health, a prominent healthcare network in Western New York. The breach involved an unsecured Elasticsearch database.
What happened
According to breach notification letters issued by Serviceaide and reports to regulators, the company learned on November 15, 2024, that certain information within an Elasticsearch database maintained for Catholic Health had been inadvertently made publicly accessible on the internet. A subsequent investigation, assisted by third-party cybersecurity specialists, determined that this unauthorized public access occurred for a period of nearly seven weeks, between September 19, 2024, and November 5, 2024. Serviceaide stated it promptly secured the database upon discovery of the exposure.
What's new
Serviceaide officially reported the incident to the HHS OCR on May 9, 2025, confirming that 483,131 individuals were affected. The review of the compromised data revealed a wide range of sensitive information was potentially exposed, varying by individual. This includes:
- Full names
- Social Security numbers
- Dates of birth
- Medical record numbers
- Patient account numbers
- Medical and health information (diagnosis, conditions, etc.)
- Health insurance information
- Prescription and treatment details
- Clinical information
- Healthcare provider names and locations
- Email addresses, usernames, and passwords
Serviceaide is offering 12 months of complimentary credit monitoring and identity theft protection services through Cyberscout (a TransUnion company) to affected individuals, who must actively enroll. Several law firms, including Strauss Borrelli PLLC, ClassAction.org affiliates, and Migliaccio & Rathod LLP, have already announced investigations into the breach, signaling potential class action lawsuits.
The intrigue
The incident is particularly notable as Serviceaide promotes itself as a provider of "agentic AI solutions" for workflow and support management, yet an apparently fundamental security oversight led to the prolonged exposure of an important client database. The nearly seven-week window of public accessibility before discovery shows the challenges organizations face in maintaining continuous oversight of their data environments, especially complex database configurations.
What they're saying
In its notification letter, Serviceaide stated, "The confidentiality, privacy, and security of personal information within our care are among Serviceaide’s highest priorities." The company also noted, "Although at this time there is no indication that your information has been accessed or used to commit identity theft or fraud in relation to this event, we are unable to rule out this type of activity."
Catholic Health posted a brief statement on its website, acknowledging that one of its vendors, Serviceaide, experienced a data breach "resulting in limited patient information being exposed online," and directed inquiries to Serviceaide's notice.
Law firms investigating the breach are emphasizing the potential harm to victims and the need to hold the responsible parties accountable for safeguarding sensitive data.
Looking ahead
Serviceaide has stated it has implemented "additional security measures to further protect against similar events occurring in the future" and reported the incident to applicable government regulators. The company is urging affected individuals to enroll in the offered credit monitoring services and to remain vigilant by reviewing account statements and credit reports.
The fallout from this breach will likely include intense scrutiny from regulators and the advancement of class action lawsuits on behalf of the nearly half a million affected patients. Healthcare organizations should carefully manage vendor risk by instituting stringent data security protocols for business associates.
Read more: Lessons from Medusind for third-party vendor agreements
FAQs
What is an Elasticsearch database?
Elasticsearch is a powerful, open-source, distributed search and analytics engine. It's used for a wide variety of cases, such as application search, website search, logging and log analytics, security analytics, and business analytics. It allows users to store, search, and analyze large volumes of data quickly and in near real-time.
What is agentic AI?
Agentic AI refers to artificial intelligence systems designed to act autonomously on behalf of a user or another system to achieve specific goals. These "agents" can perceive their environment, make decisions, and take actions independently without constant human intervention.
Why are law firms investigating this breach?
Law firms investigate data breaches to determine if the breached entity (in this case, Serviceaide) failed in its legal duty to protect sensitive information. If negligence is found, a class action lawsuit may be filed to seek compensation for affected individuals for harms such as time spent, out-of-pocket expenses, and increased risk of future identity theft or fraud.
