If they're taking patient data for research without permission, they are not ethical researchers.

Is it really “without permission” if it’s from a server for which the access credentials have been deliberately published to the entire internet?