Aichi Prefecture: names and hospitals of 495 COVID-19 patients were posted on its website by mistake
A list with patients' names, hospitals and other private details stayed on the prefecture's COVID-19 site for about 45 minutes.
Disclosed
2020-05-05
Organizations involved
1
Leaked or at risk
495
495
Downtime
Unknown
What happened
While setting up the list of cases in the prefecture, staff registered the wrong file. One employee both built and approved the page. [2]
Several inquiries after 10 a.m. revealed the error, and the file was removed; it had been up for about 45 minutes. Disclosed the same day. [1] [2]
The prefecture said it would compensate the 490 patients whose private data appeared: 40,000 yen each for 396 whose names were shown and 20,000 yen each for the other 94. [3]
Impact
For 495 cases, the list showed patients' names, the hospitals they were admitted to or moved to, admission and discharge dates, the health centers that filed the reports and cluster names, beyond the age group and gender normally published. [2]
Timeline
- Disclosed 2020-05-05
- 1 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Major]AichiPrefecture495 leaked
Aichi Prefecture
Sources
- [1][News]愛知県の新型コロナウイルス感染者の氏名等495件誤掲載ScanNetSecurity · 2020-05-07 09:00
- [2][News]愛知県、新型コロナ患者の非公開情報を誤掲載 - 氏名や入院医療機関などSecurity NEXT · 2020-05-07
- [3][News]愛知県、新型コロ患者情報の誤掲載で賠償金 - 1人あたり最大4万円Security NEXT · 2020-05-29