> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Asuka: an SQL injection on its job site exposed up to 30,000 provisional registrants on an online forum

Attackers broke into the job site of a staffing firm for nursery and care workers. Names, addresses and more appeared on a forum, and users were not told for over a month.

Disclosed

2020-07-13

Organizations involved

1

Leaked or at risk

30K

30,000

Downtime

Unknown

What happened

In May the job site was hit by SQL injection. Data of people who had pre-registered appeared on an online forum, and job pages were rewritten with threatening text. [1] [2]

  1. The company consulted the police. [1]

  2. The case came to light in the press; the company had not told users until then. [1] [2]

Impact

Names, birth dates, addresses, email addresses and nursery teacher qualifications of up to 30,000 pre-registered users leaked. [1] [2]

Timeline

  1. Disclosed 2020-07-13
  2. 1 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak][Site defacement]
Entry point
Web app

Data exposed or at risk

[Name][Date of birth][Postal address][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]人材派遣のアスカが最大3万件の個人情報を流出…1カ月以上も周知せず 弁護士は行政処分の可能性を指摘PRESIDENT Online · 2020-07-13 06:00
  2. [2][News]保育士派遣などのアスカ、サイバー攻撃受け個人情報3万件流出かCybersecurity.com · 2020-07-14