Like Academy: intrusion into a contractor's test system for the Nanapocke app puts data of children and parents at risk

1. 2020-01-23 13:50

   The contractor's test database was accessed through a flaw in part of the system. [1]

2. 2020-01-23 18:00

   Personal data was found in the database, and outside access to the server was blocked. [1]

3. 2020-01-24 13:00

   The production service and outside access to the app were also stopped. [1]

4. 2020-01-27

   An outside security firm was hired to investigate. [1]

5. 2020-02-10

   Public disclosure. [1]

• Names, postal codes, some addresses and building names, birth dates, gender and enrollment dates of {n:3754} children. [1]
• Names and some phone numbers of 2,939 parents. [1]
• The data came from licensed nurseries in Yokohama and Sagamihara and unlicensed childcare rooms in Kawanishi, Osaka's Sumiyoshi ward and Izumiotsu. [1]

The contractor's test system was reachable from outside, its database credentials were weak and the data was not properly anonymized. [1]