medico:medico

The user was medico. The password, too. According to public reports from threat intelligence and cybersecurity communities on the MiniMed Panama and Radimagen incident, linked to the provider LATAM MAXIA, the medico:medico credential was reportedly a default credential used in the system and remained active without adequate rotation ^fn-1. As of this writing, there is no complete public forensic confirmation or official determination of responsibility to validate all of the reported technical details.

Even so, the case serves to discuss a known and documented pattern of risk: default credentials, non-rotated credentials, and the absence of basic controls in systems that handle sensitive data. What hits the hardest is not the sophistication of the attack. It’s a mix of banality and disaster: someone, at some point, would have left a default credential working, probably without malice and without understanding the risk, and that five-second decision could have ended up exposing the medical privacy of more than a hundred and fifty thousand people.

This is not a post about a sophisticated exploit. It is a post about a country—mine—that has spent years accumulating technical, regulatory, and professional debt whose interest can no longer be paid.

#.The year Panama entered the dark web

If one sits down to sort out what happened between September 2025 and May 2026, the pattern is quite clear. They were not isolated attacks or bad luck: it was a season.

The following table summarizes publicly reported events. Not all of them have the same level of confirmation. Some data comes from official statements; others, from claims from threat actors, journalistic coverage, OSINT communities or third-party reports. The “Status” column tries to distinguish that level of certainty and should be read with that caution.

Three terabytes, according to the claim attributed to The Gentlemen, could be equivalent to millions of digitized files. The group claims to have data on 80% of Panamanians ^fn-2. Like any communication from a threat actor, this figure should be treated with caution: it can mix real data, exaggerations or self-serving claims. But even if the claim was inflated, the order of magnitude is still serious.

The important thing is not that there are attacks. That happens in any country and in any industry. The abnormal thing is that they are having such cheap, fast and repeatable results. Panama already knew it was exposed: in 2019, Bob Diachenko found an unprotected Elasticsearch database with data on 3.4 million Panamanians, accessible from any browser, secured 48 hours after notifying CSIRT Panama ^fn-3. We have known for at least seven years that we are exposed.

The pattern, simplified, looks like this:

#.What the law doesn’t say (and should)

It is useful to put side by side what the law requires in other places and what ours requires. No controversy, no embellishments, just the difference.

Law 81 ^fn-4 was an important advance: it recognizes sensitive data, requires consent and establishes ANTAI as an authority. But in the face of incidents of this scale, their gaps weigh: “immediate” notification without a numerical deadline, fines of B/.1,000 to B/.10,000 per violation and limited mechanisms against third parties.

The contrast in magnitude is difficult to ignore. Faced with a reported leak of 156,000 files, a ceiling of B/.10,000 makes many companies prefer to simply assume the risk: the potential penalty is negligible compared to the real cost of doing things well. Under GDPR, Meta was fined €1.2 billion in 2023 for data transfers to the United States ^fn-5. It is not about copying GDPR—it is complex, expensive, and does not apply in the same way to a country of four million—but rather about recognizing that the cost of losing sensitive data in Panama seems poorly calibrated.

Progress must also be recognized. In 2024, NIST published SP 800-66 Rev. 2, a specific technical guide to protect medical data under HIPAA ^fn-6; Panama does not have a binding equivalent. But the State does move: in August 2025 Law 478 ^fn-7 was passed, which updates the Penal Code with new criminal types for computer crimes. In June 2025, by Executive Decree 53, the Cybersecurity Center of Panama was created ^fn-8. And there is a preliminary draft reform of Law 81 that proposes raising fines up to B/.100,000. The state apparatus is moving. What is still missing is for culture, the market and public conversation to move with the same seriousness.

#.The industry that charges the same for doing it wrong

Here I want to connect with something I already wrote in The forgotten art of good code: we have exchanged quality for immediacy, we accept code generated without thinking, and the result is a generation more focused on speed than on craft. In the abstract, that’s technical debt. Applied to a system that stores medical records, it is the difference between a person being able to apply for a loan or not the day they discover that their diagnosis is on Telegram.

In fifteen years of career I have seen systems with plaintext passwords delivered by providers that charge the same (sometimes more) than those who do know what they are doing, public tenders awarded by price where the security rubric weighs five points out of a hundred, audits that mark “encryption was used” without asking algorithm or key management, and serious projects lose against cheaper offers that do not internalize the risk.

Ross Anderson, in Security Engineering ^fn-9, explains it from the economics of security: if whoever buys does not directly suffer the breach, if whoever builds does not bear the cost of the failure and if reputation is recovered cheaper than doing it well, the market equilibrium is to produce insecure software. Bergh Johnsson, Deogun and Sawano, in Secure by Design ^fn-10, look at it from the design: security is not “added” at the end, it is modeled from the beginning. When a supplier delivers a product with medico:medico as the default credential, it is not just carelessness: it is that the design culture never considered security to be a property of the system.

The result is predictable: the talent that does know moves towards markets with international rates where quality is paid for, while local critical projects end up operating with budgets, deadlines and standards that do not always correspond to the real risk of the data they handle. When the market does not reward quality, quality disappears.

IBM’s report confirms this Cost of a Data Breach 2024

#.Regulators and those who look the other way

There is one detail from March 2026 that still bothers me: at least in the early days, the most detailed publicly available information about what happened at the CSS seemed to come more from attackers’ claims than from a full institutional explanation. I’m not asking CSS to publish the playbook of the attack. I’m saying that, from a crisis communication perspective, no firewall is a substitute for a clear, timely, and verifiable public explanation.

The AIG exists and has a technical team, but it does not appear to publicly have a binding framework equivalent to NIST or an audit and enforcement mandate comparable to that of OCR in the United States on entities covered by HIPAA. ANTAI, charged with enforcing Law 81, operates—according to local specialists—with budget and technical personnel limitations. The problem seems less one of individual will than of institutional design.

The media coverage that I saw during this season, with specific exceptions, tended to reproduce official statements rather than to technically translate the risk for the citizen. The Verizon DBIR 2024 report ^fn-12 has been explaining the pattern for years: about 38% of breaches involve stolen credentials and 68% involve a human element — errors, social engineering, misuse. They are not secret figures.

And here I want to be honest: I am not a security expert. I am an engineer who has had to learn security because the job requires it of me. But there are people in Panama who are and who have been doing public pedagogy work for years for free and without a commercial agenda. André Conte (@AndreBConte), an analyst linked to OWASP Panama, is one of those local voices. IPANDETEC, a Panamanian digital rights organization, leads the Multisectorial Cybersecurity Roundtable and probably does the most sustained public advocacy work in the country ^fn-13. UTP, through its Faculty of Computer Systems Engineering, maintains formal cybersecurity programs and a research group, CyGISI ^fn-14. OWASP Panamá, Bsides Panamá, STIC Panamá maintain community. The people who know are there. What is missing is not local expertise — what is missing is the bridge between that expertise and the public conversation.

#.Why should you care?

If you made it this far, the question you have is probably the most legitimate: what does this have to do with me? The answer depends on who you are.

The recommendations that follow are general measures. They do not replace personalized legal, financial, banking, medical or cybersecurity advice.

#.As a person and user

Your ID, your medical history, the passwords you reuse between five services. That’s what’s at stake when we talk about “personal data.” And while the public conversation often veers toward “be careful what you share,” the truth is more uncomfortable: You don’t decide how your file is stored at the clinic, how your information is encrypted at the bank, how a credential is rotated at a medical software provider. Those decisions are made by others, on your behalf.

That’s why this section doesn’t ask you to do anything. It explains why your information should matter to three groups of people who can change things.

To companies. Because when a system fails and data ends up where it shouldn’t, the main cost is not paid by the board of directors: it is paid by you. You with the call from the scammer who knows how much you owe. You with the phishing email that knows the name of your treating doctor. You with the possibility that a diagnosis leaves the office and ends up weighing on a work decision that no one explains to you. A company that takes care of your data does so because it knows that between its balance sheet and your daily life there is a distance that should not exist.

To engineers. Because every credential you decide not to rotate, every hash you decide to skip, every database you decide to expose “just for now” are decisions that affect specific people who will never know your name. You did not sign the contract for the system that stores your history. You did not participate in the code review. But the five-second decision that left the credential active could have exposed many people’s medical privacy for years. The craft of building software is measured, in the end, by the respect you have for the person who will never read a single line of code.

To lawyers, lawmakers, and politicians. Because without rules that hurt, the incentives do not change. Until there is an authority with a budget, technical capacity and sanction mechanisms comparable to those of international frameworks, suppliers will not feel real pressure. Laws and legal processes are the only thing that turns a lazy technical decision into a problem with consequences. Without that, you—the citizen whose information may have been reported on the dark web—are left with a statement, a promise, and a pattern that repeats itself.

#.As a software engineer

This touches you directly. If you deliver software, you are part of the chain that decides whether the next medico:medico exists or not.

Before the list, a premise that should not be forgotten: medical systems do not have to be comfortable if that comfort compromises security. On the contrary: they should be as uncomfortable as necessary to protect the type of information they hold. Well-placed friction isn’t bad UX — it’s protection.

The minimum is not aspirational; It’s professional hygiene. The HIPAA Security Rule (45 CFR Part 164, Subpart C) and NIST SP 800-66 Rev. 2 ^fn-6 are not binding in Panama, but work perfectly as a technical floor:

• Encryption in transit and at rest, with serious key management (HSM or KMS managed) and without PHI/PII in logs, backups or queues. When applicable—telemedicine, doctor-patient messaging, transfer of diagnostic images—end-to-end encryption without the possibility of even the provider reading the messages in clear.
• Password hashing with properly configured Argon2id or bcrypt, unique salt per password and periodically reviewed cost parameters ^fn-15.
• MFA and least privilege. Mandatory MFA in all administrative, production and sensitive data access; ideally FIDO2/WebAuthn or passkeys — SMS does not count as a serious second factor. Each user, service or process with the minimum necessary access, separating administrative and operational accounts. HIPAA requires this under Information Access Management (164.308(a)(4)).
• Private and auditable databases. Without direct exposure to the internet. Access only through backend/API or via VPN/bastion, with network segmentation. And immutable records of every access to PHI: HIPAA requires this under Audit Controls (164.312(b)). If you can’t answer “who read this person’s file on Tuesday at 3 PM?”, you have a problem before the incident.
• Zero credentials by default and a documented and rehearsed incident response plan. OWASP Top 10 A07 and CIS Control 5 have been saying the former for years. HIPAA requires the latter under Security Incident Procedures (164.308(a)(6)). The time to write the plan is not when you are already inside the incident, looking at the clock.

If you deliver a system with a default credential like medico:medico and allow it to reach production, it is not enough to say “the customer did not demand it”: that failure is also the professional responsibility of the person building and delivering. I already wrote in The forgotten art of good code about how we accept that generating fast code replaces writing good code. This is the version where that code is saving the medical history of real people.

And if you want to go further: Anderson ^fn-9 and Bergh Johnsson et al. ^fn-10 are must-reads. Locally, OWASP Panama and Bsides Panama are where the live conversation is.

#.As a journalist

If you work in the media, this section is a favor: one of the most important citizen rights stories in the country is happening now, and coverage has tended to reproduce statements with little technical translation. It is not bad faith; it is the rhythm of the newsroom. But “an intrusion was detected” does not tell the citizen what data is at risk, what can be done with it, or how different “credentials were leaked” is from “medical records were leaked.”

The source exists and is free: local technical voices, universities, cybersecurity communities—those I already mentioned in the previous section—can translate these events without turning them into a spectacle. What is missing is the call.

#.As a lawyer, lawmaker, or politician

Here I correct something I wrote in a previous version: saying that “we haven’t seen a single collective action” was unfair. IPANDETEC has been doing public advocacy on digital rights for years ^fn-13. Lawmakers like Yarelis Rodríguez have promoted specific legislation — including Law 478 ^fn-7 and the draft reform of Law 81. ANTAI, the authority in charge of Law 81, has not yet formally ruled on the incidents of this season at the time of writing this, and that statement — along with the eventual application of the first corresponding sanctions — is something that many of us are waiting to see.

What is still missing is a visible bridge between leaks that potentially affect millions of people and concrete mechanisms for accountability, collective protection and sanctions. It is not my turn to propose the legal figure: I am not a lawyer. But I can point out, as a citizen and engineer, that this void exists.

If you are a lawmaker, lawyer, or in a political decision-making position, your voice from your field can help ensure that the existing instruments—and those that are in queue, such as the reform with fines of up to B/.100,000—do not remain on paper.

#.As a company

Recommendations for companies are indicative and must be adapted to the sector, size, regulatory obligations, applicable contracts and corresponding professional advice. They do not constitute formal legal, compliance or cybersecurity advice.

If you handle customer data, sensitive data or medical data, this applies to you. The public reports on the case attributed to LATAM MAXIA, if correct, illustrate a known risk: when a supplier fails or is compromised, the impact can spread to its customers. It is a classic supply chain pattern, and in healthcare the explosion radius can be enormous.

What’s boring is what’s important:

• Before signing with a supplier: ask for documented evidence of security — not a piece of paper that says “we comply with Law 81.” Ask for the report of your last external audit, how you manage the credentials lifecycle, how you report incidents and within what period, and who bears civil liability if something leaks.
• Annual external audits, not internal audits — done by people who do not depend on your payroll.
• Documented incident notification plan, before you need it.
• Hire whoever knows. If security weighs five points out of a hundred in a tender, the result will probably reflect that priority. Paying cheaply for a system that stores medical data is a decision that you pay later, with interest.

Three uncomfortable questions before signing are always cheaper than a breach afterward.

The common denominator is simple: information is not the problem. Panama has universities, technical communities, specialists and digital rights organizations capable of understanding this. What is missing is for each actor—company, engineer, journalist, lawyer, regulator, politician—to accept that it is their turn.

Let’s go back to the beginning: medico:medico. A credential that looks like a placeholder. The day that makes us professionally embarrassed before reaching production, we begin to leave the dark web. And meanwhile, the data is still there.

Update and right to clarification. If any institution, company, supplier, specialist or authority mentioned considers that any cited data is incomplete, outdated, or requires clarification, they can contact me to review the corresponding public source and, if necessary, correct or update the text. This article seeks to contribute to an informed public conversation, not to replace official investigations or to attribute responsibilities that correspond to the competent authorities.