Sapporo Gakuin University: a list of 2,524 students sat open on its web server for over three years
An Excel file with the student numbers and names of 2,520 students from 2016 and four others sat on Sapporo Gakuin University's web server, where search engines could find it.
Disclosed
2020-02-28
Organizations involved
1
Leaked or at risk
2.5K
2,524
Downtime
Unknown
What happened
A lecturer at the time saved an Excel file with student data to the university's web server by mistake, without hiding the file listing. [1]
An inquiry said student data could be found through Google search, and the university checked. [1]
The file was removed and Google was asked to delete its cached copy. [1]
Public disclosure. [1]
Impact
The student numbers and names, with readings, of {n:2520} students enrolled in 2016 and 4 students of one course could be reached from outside for about three and a half years. [1]
Response
The university said it would retrain staff and part-time lecturers on handling personal data. [1]
Timeline
- Started 2016-09-20
- Detected 2020-01-29
- Disclosed 2020-02-28
- 1256 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Major]Hokkaido, EbetsuEducation and learning support2,524 leaked
Sapporo Gakuin University
Sources
- [1][News]Webサーバにうっかり Excel 保存、3年のあいだ2,500名の学生情報にアクセス許す(札幌学院大学)ScanNetSecurity · 2020-03-05 08:00