A US-based provider of health services was recently discovered to have had a fax server and accompanying Elasticsearch database connected to the web – without a password.