> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Aichi Prefecture: names and hospitals of 495 COVID-19 patients were posted on its website by mistake

A list with patients' names, hospitals and other private details stayed on the prefecture's COVID-19 site for about 45 minutes.

Disclosed

2020-05-05

Organizations involved

1

Leaked or at risk

495

495

Downtime

Unknown

What happened

  1. While setting up the list of cases in the prefecture, staff registered the wrong file. One employee both built and approved the page. [2]

  2. Several inquiries after 10 a.m. revealed the error, and the file was removed; it had been up for about 45 minutes. Disclosed the same day. [1] [2]

  3. The prefecture said it would compensate the 490 patients whose private data appeared: 40,000 yen each for 396 whose names were shown and 20,000 yen each for the other 94. [3]

Impact

For 495 cases, the list showed patients' names, the hospitals they were admitted to or moved to, admission and discharge dates, the health centers that filed the reports and cluster names, beyond the age group and gender normally published. [2]

Timeline

  1. Disclosed 2020-05-05
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Health data]

Organizations involved

Open in organization search

Sources

  1. [1][News]愛知県の新型コロナウイルス感染者の氏名等495件誤掲載ScanNetSecurity · 2020-05-07 09:00
  2. [2][News]愛知県、新型コロナ患者の非公開情報を誤掲載 - 氏名や入院医療機関などSecurity NEXT · 2020-05-07
  3. [3][News]愛知県、新型コロ患者情報の誤掲載で賠償金 - 1人あたり最大4万円Security NEXT · 2020-05-29