JICE: intruders took email addresses and passwords of 1,984 people from the portal of a JICA study program

In late April JICE began a vulnerability test of the ABE Initiative portal, which it runs for JICA. The test found a flaw that let outsiders into the site, and the logs showed that intruders had used it. The site was closed. [1] [4]

1. 2020-06-12

   Public disclosure; the people affected were sent an explanation and apology by email. [1] [3]

2. 2020-06-30

   Follow-up report: a review back to the January 2015 launch found 44 more intrusions. [2] [6]

Email addresses and login passwords of 1,984 people leaked: 1,225 students from Africa, 652 staff of host universities, 102 people who had made inquiries, and five JICA and JICE staff. [1] [4]

The follow-up also confirmed leaks of login IDs, passwords, email addresses and Japanese addresses of 10 students, plus email addresses of 17 and login IDs and passwords of 104 university staff. With the stolen logins, personal data of the 10 students, including sensitive data, and of 718 university staff may have been accessed. [2]

JICE said it would run regular vulnerability tests and watch for intrusions at all times, and would ask users to change their passwords when the site reopened. [2]