Faisal is an IT administrator at an outpatient clinic group in Dubai.
Before a big system migration, he made a full backup of the patient database, the careful way.
Five months later, patients started getting phone calls from strangers who knew their last visit.
The full story
The clinic group was moving to a new patient system over a long weekend. Four clinics, one go-live, no room for anything to go wrong.
So on Thursday night Faisal did what any good IT administrator does before a big change. He took a full backup. He copied the entire patient database onto a portable drive, just in case.
The encryption step would have added three hours. It was 11 pm. He skipped it. The drive went into his bag, and the go-live started at dawn.
He thought of it as a safety net. It was every patient the clinics had ever seen: 26,400 people. Names and mobile numbers. Copies of their ID cards. Insurance card details. Every appointment — which clinic, which doctor, which date.
On an encrypted drive, that would have been a locked box. On this one, anyone who plugged it in could open it like a folder of photos.
The migration went perfectly. Not one record lost. On Monday the drive went into his desk drawer, with a sticky note: “OLD SYSTEM BACKUP.”
Nothing happened for five months. Nothing ever does, at first.
In the spring the head office moved to a new floor. Faisal was at a clinic that week, setting up the new waiting-room screens. The movers emptied the IT drawers into a box marked “old equipment”: cables, old keyboards, two dead phones, and a portable drive whose sticky note had fallen off.
The box went out with the e-waste collection. Nobody listed what was in it. Nobody had a list of the backups in the first place.
It didn't start with an alert. It started at reception. A patient called the clinic, upset. Someone had phoned her, knew her name, her insurance details and the date of her last visit, and asked for her card number to “process a refund.”
Two more patients called that week with the same story. The new system was clean. Nothing inside the clinics had been broken into.
It took IT two weeks to work out where the details could have come from: an unencrypted copy of the old database that had left the building in a box, and was now somewhere no one could reach.
Nobody stole anything. Nobody broke in. The data simply walked out, with the rubbish.
This is what the review found. Not as background. As verdict.
3 things your team can do before the next big IT change:
1. Encrypt every copy. If a backup leaves the server, it should be unreadable to anyone who finds it.
2. Keep a list of copies. What was copied, where it is, and the date it will be wiped.
3. Check before anything leaves. Drives and devices are wiped and signed off before they go to storage, resale or e-waste.
Faisal still takes a backup before every change. It's encrypted now, it's on a list, and it's wiped when the job is done. Does your team know where its copies are?
If your organisation needs to close this gap, the training exists, built for exactly this.
training.cybernym.io/login/?tab=demo
Cybernym.io — Cyber Instincts. Built, Not Taught.
Real UAE breach stories, told simply — a few minutes each.
Built for HR, L&D, marketing and compliance teams across the UAE.
Thank you for following The Breach Brief.
Read the full story above — and watch your inbox for what comes next.
