> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Doshin Service Center: a contractor's engineer left code and client data, including 15,599 personal records, public on GitHub for four months

A contractor of Doshin Service Center, an advertising firm, made source code and 28,515 client records, 15,599 with personal data, public by mistake.

Disclosed

2020-03-26

Organizations involved

1

Leaked or at risk

28.5K

28,515

Downtime

Unknown

What happened

  1. An engineer at the contractor, working on a software development platform, set the company's source code and client data so that outsiders could see them. [1]

  2. Another engineer at the contractor noticed and closed access the same day, but the contractor did not tell the company. [1]

  3. A company employee learned that client data had been public and asked the contractor; its check and the platform's logs confirmed the leak. [1]

  4. Public disclosure. [1]

Impact

{n:28515} client records, of companies and individuals, could be viewed; 15,599 of them held personal data such as names, addresses, phone numbers and email addresses. [1]

Timeline

  1. Started 2019-10-07
  2. Detected 2020-03-13
  3. Disclosed 2020-03-26
  4. 171 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address]

Supply chain

Organizations listed on this site
1

Organizations involved

Open in organization search

Sources

  1. [1][News]GitHubの設定ミスが原因、取引先情報が外部から閲覧可能に(道新サービスセンター)ScanNetSecurity · 2020-03-30 08:00