A serious data breach at Rajkot Civil Hospital in Gujarat has exposed critical lapses in cybersecurity practices within the healthcare sector. According to reports, CCTV footage from inside the hospital was allegedly hacked and uploaded to pornographic websites and Telegram channels, after attackers gained access through the default password “admin123.”
Investigations revealed that the hospital’s digital video recorder (DVR) system which stored CCTV footage from various wards had been secured with one of the most commonly used weak passwords, “admin123.” This vulnerability allowed unauthorized users to gain full access to the hospital’s live and recorded surveillance feeds.
Hackers reportedly sold and circulated the footage on online platforms, some of which were linked to adult content websites. Several clips reportedly showed women patients and staff in compromising situations, sparking outrage and concerns about patient privacy and hospital data protection.
Healthcare facilities often lack strong cybersecurity protocols. Hospitals, clinics, and diagnostic centers store vast amounts of sensitive patient information and rely heavily on surveillance systems. Yet, many of these systems remain vulnerable due to outdated software, weak passwords, and lack of regular audits.
According to a 2023 report in the Journal of Medical Internet Research, healthcare organizations are among the top targets for cyberattacks globally, due to both the value of medical data and insufficient IT security measures.
Following the incident, the Gujarat Police’s cybercrime cell initiated an investigation to track the origins of the breach and identify the individuals involved in the sale and distribution of the footage. The state health department has also directed all government hospitals to review and strengthen their data security frameworks, particularly for surveillance and patient information systems.
The breach raises serious ethical and legal questions surrounding patient privacy and the responsibility of institutions to protect personal data. Under the Digital Personal Data Protection Act (2023), such unauthorized access and misuse of personal or sensitive data may constitute punishable offenses.
Medical ethics also mandates that healthcare institutions ensure confidentiality and dignity of all patients, extending to digital and video records. Experts have called for mandatory cyber hygiene audits, staff training, and encrypted surveillance systems to prevent similar incidents in the future.
The Rajkot incident serves as a critical reminder of the consequences of poor password management and inadequate data protection practices.
Cyber experts recommend that all healthcare facilities:
Use strong, unique passwords and enforce regular updates.
Conduct routine security audits of CCTV and data storage systems.
Implement two-factor authentication and encrypted video storage.
Train staff on cybersecurity awareness and privacy protocols.
(Rh/TL)