Doshin Service Center: a contractor's engineer left code and client data, including 15,599 personal records, public on GitHub for four months
A contractor of Doshin Service Center, an advertising firm, made source code and 28,515 client records, 15,599 with personal data, public by mistake.
Disclosed
2020-03-26
Organizations involved
1
Leaked or at risk
28.5K
28,515
Downtime
Unknown
What happened
An engineer at the contractor, working on a software development platform, set the company's source code and client data so that outsiders could see them. [1]
Another engineer at the contractor noticed and closed access the same day, but the contractor did not tell the company. [1]
A company employee learned that client data had been public and asked the contractor; its check and the platform's logs confirmed the leak. [1]
Public disclosure. [1]
Impact
{n:28515} client records, of companies and individuals, could be viewed; 15,599 of them held personal data such as names, addresses, phone numbers and email addresses. [1]
Timeline
- Started 2019-10-07
- Detected 2020-03-13
- Disclosed 2020-03-26
- 171 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Supplier
Data exposed or at risk
Supply chain
[Breached]
[Breached]
- Organizations listed on this site
- 1
Organizations involved
[Through a supplier][Major]Hokkaido, Sapporo, ChuoScientific research, professional and technical services28,515 leaked
Doshin Service Center Inc.An engineer at the company it hired for system work set the online development platform to public by mistake.
Sources
- [1][News]GitHubの設定ミスが原因、取引先情報が外部から閲覧可能に(道新サービスセンター)ScanNetSecurity · 2020-03-30 08:00