S-Collection: intruders reached the server of its e-pledge service and downloaded the personal data of signers since 2016

1. 2020-03-02

   From an IP address in Ireland, someone operated the database of the e-pledge service and downloaded signers' personal data. [1] [2]

2. 2020-03-03

   At 8:50 a.m. the company's system team noticed something wrong with the database; the server was shut down at 1:54 p.m. The company consulted the police. [1]

3. 2020-03-04

   Public disclosure and a report to the Personal Information Protection Commission. [1]

4. 2020-03-30

   An interim report from an outside investigator confirmed the leak. The likely cause was a password attack that let the intruder obtain a password. [1]

5. 2020-03-31

   Second report published. Fixes for the weak points had been finished on 2020-03-22. [1]

Names, addresses, phone numbers and email addresses of people who signed pledges from 2016-07-24 to 2020-03-02, and names and email addresses of people still signing, leaked. The number of people was not given. [1] [2]

The company said it would use stronger passwords, check them regularly and review who may access the system. [1]