> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Keidanren Jigyo Service: a rewritten site program may have leaked about 500 seminar and book orders

The site's program had been rewritten so that details entered by seminar and book applicants were saved to a file the attacker chose.

Disclosed

2020-05-28

Organizations involved

1

Leaked or at risk

500

500

Downtime

Unknown

What happened

  1. Preparing a site overhaul, the contracted site management firm found the rewritten program. The file it created showed signs of outside access. [1] [2]

  2. The attacked server was shut down. [1] [3]

  3. Public disclosure; business continued through a temporary site and email. [1] [3]

Impact

Company or organization names, departments, titles, names, addresses, phone and fax numbers and email addresses in about 500 applications made from to may have leaked. [1] [3]

Timeline

  1. Started 2020-01-21
  2. Detected 2020-05-21
  3. Disclosed 2020-05-28
  4. 128 days

Organizations involved

Open in organization search

Sources

  1. [1][News]経団連の関連団体、約500件の個人情報流出か Webサイトに不正アクセスITmedia NEWS · 2020-05-29 15:28
  2. [2][News]不正アクセスで個人情報流出か - 経団連事業サービスSecurity NEXT · 2020-05-29
  3. [3][News]プログラム改ざん、申し込み者情報は攻撃者指定のファイルへ書き込み(経団連事業サービス)ScanNetSecurity · 2020-06-01 08:00