> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

MHLW: the online application system for employment adjustment subsidies stopped on day one after showing other applicants' details

People registering at the same moment in the COVID-19 subsidy system got the same ID and saw each other's names and phone numbers. A June restart leaked data again.

Disclosed

2020-05-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Soon after the system opened around 10 a.m., reports came in that other applicants' names, phone numbers and email addresses were visible, and it was shut down within about an hour. About 2,000 registrations had been made by then. [2] [5]

  2. Health minister Katsunobu Kato apologized and explained that several people registering at the same time had been given the same ID. [5]

  3. The system reopened at noon but was shut again after another fault: at least one company's application papers could be seen by other businesses. [3]

  4. The ministry said pay slips and other data of two employees of one company had leaked and been viewed by 10 companies. [4]

Background

The ministry had ordered the system from Fujitsu without competitive bidding, and Fujitsu had passed work on to three other companies. [3]

Timeline

  1. Detected, Disclosed 2020-05-20
  2. 1 days

Organizations involved

Open in organization search

Sources

  1. [1][News]雇用調整助成金、システム不具合 個人情報閲覧可能にNikkei · 2020-05-20
  2. [2][News]「雇用調整助成金」の受付システムに不具合 - 他申請者情報が閲覧可能にSecurity NEXT · 2020-05-21
  3. [3][News]雇用調整助成金、申請情報漏れ オンライン停止Nikkei · 2020-06-05
  4. [4][News]雇調金オンライン申請、2人分の給与明細漏洩、10社閲覧Nikkei · 2020-06-09
  5. [5][News]助成金受付システムが2度停止、短納期がミス誘発かNikkei xTECH · 2020-07-14