> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Sapporo Gakuin University: a list of 2,524 students sat open on its web server for over three years

An Excel file with the student numbers and names of 2,520 students from 2016 and four others sat on Sapporo Gakuin University's web server, where search engines could find it.

Disclosed

2020-02-28

Organizations involved

1

Leaked or at risk

2.5K

2,524

Downtime

Unknown

What happened

  1. A lecturer at the time saved an Excel file with student data to the university's web server by mistake, without hiding the file listing. [1]

  2. An inquiry said student data could be found through Google search, and the university checked. [1]

  3. The file was removed and Google was asked to delete its cached copy. [1]

  4. Public disclosure. [1]

Impact

The student numbers and names, with readings, of {n:2520} students enrolled in 2016 and 4 students of one course could be reached from outside for about three and a half years. [1]

Response

The university said it would retrain staff and part-time lecturers on handling personal data. [1]

Timeline

  1. Started 2016-09-20
  2. Detected 2020-01-29
  3. Disclosed 2020-02-28
  4. 1256 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Education]

Organizations involved

Open in organization search

Sources

  1. [1][News]Webサーバにうっかり Excel 保存、3年のあいだ2,500名の学生情報にアクセス許す(札幌学院大学)ScanNetSecurity · 2020-03-05 08:00