The whole story started with a strange-looking pull request on a repo of Tom Forbes, which collects metadata for every PyPI package.
The package the user wanted removed, ihip, appeared to be an internal Infosys package, probably published by accident in February 2021.
Its release file was still downloadable, with an AWS access key and secret key embedded as string constants.
They were still active and gave access to an S3 bucket with a folder called John_Hopkins_Hospital, presumably holding clinical data.
The key had AdministratorAccess, every action on every service: hardly a development key.
Then the same user submitted a takedown request for an unrelated package on pypi-data.
With no security contact at Infosys to be found, Tom deleted the key himself.
Usually a no-go, but with clinical data at stake it seemed the best option.
Infosys told The Stack that the key belonged to an isolated proof-of-concept subscription with only test data, and that “there is no loss of data”.
Whether that test data held real patient records was still unanswered at publication.
