The Russian government has confirmed spreadsheets containing private details of Covid-19 patients from Moscow have been published online.
An official has said an internal inquiry found a mistake had been made rather than hackers being to blame.
Readovka, the news site that revealed the leak, says the files indicate official statistics may have under-reported the true number of cases.
It says 300,000 names are listed alongside diagnoses and test results.
Medical insurance numbers, home addresses, telephone numbers and passport details were also featured alongside other personal information.
Current Time - a news network led by Radio Liberty in co-operation with Voice of America - has also carried out checks of its own on the data to confirm the details matched those of real people.
According to Russian news agency Tass, 660,073 cases of the coronavirus have officially been detected in Moscow.
But the files contain only a subset of these.
"During the checks, we have established that there has been no violation of the information system of the Moscow city government," Moscow Department of Information Technologies head Eduard Lysenko said.
"The leak occurred due to human error - members of staff who were processing these documents had allowed for the files to be passed on to third persons."
"Measures" would follow, he added, which some local reports have taken to mean there could be criminal prosecutions.
Tass reported 362 Excel files involving a total of 940MB of data had been uploaded, some running to more than 100,000 lines.
The affair comes a week after it was revealed the personal data of everyone who had ever registered with Brazil's publicly-funded healthcare system had been put at risk by a password being accidentally left in the code of the government's Covid-19 notification system.
More than 200 million living and dead people's names, addresses and other details could have been decrypted and accessed as a consequence.
Brazil's government has said the issue has been fixed.