Postmortem: 3/6/2025 PII Leak on PDF in Drupal CMS

[gracekretschmer-metrostar]

User Story or Problem Statement

Description or Additional Context

So basically, a PDF was flagged that when it was downloaded in the prefilled fields contained PII. Originally MM thought this wasn't Drupal. Erika had me look this morning and I found it linked on a Tampa VAMC detail page. I removed the link, deleted the PDF from Drupal and then had Edmind deleted it from the DB

Erika has emailed Justin to let Tampa know this happened and to address the removal of the PDF because now that is creating a 404 so they may want to update a new, clean form without PII

Link to Incident Report

https://yourit.va.gov/now/nav/ui/classic/params/target/incident.do%3Fsys_id%3D23744376970c26d4e0cafb56f053af20%26sysparm_stack%3D%26sysparm_view%3D

Steps for Implementation

Acceptance Criteria

• The root cause of how the PII leak happened
• A solution is implemented to resolve the PII leak
• Postmortem report submitted to Github repo.

[gracekretschmer-metrostar]

Link to draft postmortem report here: https://vfs.atlassian.net/wiki/x/OYBj6g?atlOrigin=eyJpIjoiYzIwOWJhYWI4YjhjNDdiNDliY2I2OTBjNmNjZTAzNDMiLCJwIjoiYyJ9

[smarithaponnala]

Postmortem Report: https://vfs.atlassian.net/wiki/spaces/PCMS/pages/3932389433/Postmortem+3+7+2025+PII+Leak+of+PDF+in+Drupal+CMS+and+VA.gov