> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Japanese Association of Certified Orthoptists: members-only lists of 1,631 people showed up in search engines

Member list PDFs that should have needed a login appeared in Google and Bing search results.

Disclosed

2020-04-25

Organizations involved

1

Leaked or at risk

1.6K

1,631

Downtime

Unknown

What happened

  1. A member reported that part of the member list could be seen online. The firm maintaining the member system found that member data meant to need a login was open to search engines. [1]

  2. Public disclosure; the pages no longer appear in search. [1]

Impact

In Bing, lists for Tokyo (960), Aichi (365), Okayama (155), Hiroshima (107) and Ehime (44) appeared, 1,631 people in total, with names alone or names and workplaces. Google showed the Okayama list. Server logs showed the Okayama and Hiroshima lists were opened 46 times from search. When the exposure began could not be determined. [1]

Timeline

  1. Detected 2020-04-21
  2. Disclosed 2020-04-25
  3. 4 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][News]Google, Bing 検索結果に表示された会員名簿、都道府県別一覧（日本視能訓練士協会）ScanNetSecurity · 2020-04-30 08:00