More than 62,000 records belonging to Lithuania's Ministry of Health were exfiltrated by attackers after they exploited a vulnerability in a third-party Apache Superset deployment, the ministry confirmed. Health Minister Maria Jakubauskene stated that the intrusion was reported to the ministry by the State Service for Accreditation of Medical Activities, with the compromise occurring between June 7 and June 8, 2026. Officials stressed that the affected system was not the central e-health platform where confidential patient records are stored.
What Happened
According to the ministry, the State Service for Accreditation of Medical Activities detected an emergency and escalated it on Tuesday. Preliminary analysis indicates that an unauthorized connection was established by abusing a vulnerability in Apache Superset, an open-source business intelligence and data exploration tool used to build dashboards and query datasets.
The breach window is narrow, spanning June 7 to June 8, suggesting the attackers identified the exposed instance, gained access, and pulled data over a short period. The intrusion targeted the accreditation service's environment rather than the national e-health system, a distinction the ministry was quick to emphasize in order to reassure the public that core patient health data was not the entry point.
What Was Taken
The attackers accessed a substantial volume of professional and operational data. Based on the ministry's disclosure, the stolen records include:
- Professional and contact information for healthcare specialists, totaling more than 62,000 records
- Data belonging to administrators of the institution
- Information on multi-level competencies and professional qualifications
- Systematic technical metadata from the platform
While the ministry asserts that confidential clinical patient data was not held in this system, the exposed dataset is far from harmless. Contact details, professional credentials, and administrator information for tens of thousands of medical specialists represent a high-value target for follow-on social engineering, credential abuse, and targeted phishing against the healthcare workforce.
Why It Matters
This incident underscores a recurring pattern in government-sector breaches: the soft underbelly is rarely the flagship, heavily defended system. It is the adjacent, third-party, or open-source tooling that quietly accumulates sensitive data and receives far less security scrutiny. A business intelligence dashboard tool became the doorway into a national accreditation registry.
For defenders, the strategic lesson is that data classification and network segmentation claims must be backed by reality. Even if "confidential patient data" was not directly exposed, a registry of 62,000 healthcare professionals with contact and competency data is a powerful resource for adversaries seeking to map, impersonate, or target a country's medical infrastructure. In the current geopolitical climate surrounding the Baltic states, state-aligned actors have a clear interest in such datasets.
The Attack Technique
The ministry attributes the breach to a vulnerability in Apache Superset, an open-source tool. Apache Superset has a documented history of security issues, including authentication and authorization weaknesses tied to default or weak configuration of its secret keys, which can allow attackers to forge session cookies and gain administrative access. Misconfigured or internet-exposed Superset instances running outdated versions are a known and actively scanned-for target.
The "unauthorized connection" described by officials is consistent with an attacker reaching an exposed instance and leveraging a known flaw to authenticate or escalate, then using Superset's native data query and export capabilities to harvest the connected datasets. Because Superset is designed to read from and visualize backend databases, compromising it can grant indirect access to whatever data sources it is wired into, which would explain how the accreditation registry was reached.
What Organizations Should Do
- Inventory and patch Apache Superset immediately. Identify every Superset instance in your environment, confirm the version, and upgrade to a current release that addresses known authentication and SECRET_KEY vulnerabilities.
- Rotate the Superset SECRET_KEY and all connected database credentials. A leaked or default secret key allows session forgery; rotate it along with any service accounts the tool uses to reach backend data.
- Remove third-party BI and dashboard tools from public internet exposure. Place Superset and similar tooling behind a VPN, SSO, or zero-trust gateway, and restrict access by IP and identity.
- Segment data sources from analytics tooling. Limit the datasets a BI tool can reach to only what is necessary, using read-only, scoped accounts so a compromise cannot pivot into the full registry.
- Audit logs for the June 7 to June 8 window and beyond. Hunt for anomalous queries, bulk exports, and unfamiliar authentication events in Superset and connected databases.
- Notify and harden the affected workforce. With 62,000 specialists' contact and professional details exposed, prepare those individuals for targeted phishing and impersonation attempts, and enforce phishing-resistant MFA across staff accounts.