MHLW: the online application system for employment adjustment subsidies stopped on day one after showing other applicants' details
People registering at the same moment in the COVID-19 subsidy system got the same ID and saw each other's names and phone numbers. A June restart leaked data again.
Disclosed
2020-05-20
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
Soon after the system opened around 10 a.m., reports came in that other applicants' names, phone numbers and email addresses were visible, and it was shut down within about an hour. About 2,000 registrations had been made by then. [2] [5]
Health minister Katsunobu Kato apologized and explained that several people registering at the same time had been given the same ID. [5]
The system reopened at noon but was shut again after another fault: at least one company's application papers could be seen by other businesses. [3]
The ministry said pay slips and other data of two employees of one company had leaked and been viewed by 10 companies. [4]
Background
The ministry had ordered the system from Fujitsu without competitive bidding, and Fujitsu had passed work on to three other companies. [3]
Timeline
- Detected, Disclosed 2020-05-20
- 1 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, ChiyodaNational government
Ministry of Health, Labour and Welfare
Sources
- [1][News]雇用調整助成金、システム不具合 個人情報閲覧可能にNikkei · 2020-05-20
- [2][News]「雇用調整助成金」の受付システムに不具合 - 他申請者情報が閲覧可能にSecurity NEXT · 2020-05-21
- [3][News]雇用調整助成金、申請情報漏れ オンライン停止Nikkei · 2020-06-05
- [4][News]雇調金オンライン申請、2人分の給与明細漏洩、10社閲覧Nikkei · 2020-06-09
- [5][News]助成金受付システムが2度停止、短納期がミス誘発かNikkei xTECH · 2020-07-14