[Resolved][Severity: Major][Intrusion]

Johnan Shingaku Kenkyusha: an attack on the server behind its cram school sites may have leaked 34,263 enquiry records

Data on the cram school group's websites was wiped, and names, schools and other details of 34,263 people who asked for brochures or trial lessons since April 2016 may have leaked.

Disclosed

2020-07-16

Organizations involved

Leaked or at risk

34.3K

34,263

Downtime

Unknown

What happened

2020-07-11 09:00
Staff found the websites could not be viewed and contacted the site builder and the system operator. [1]
2020-07-11 12:10
The operator reported a suspected intrusion and lost data. [1]
2020-07-11 20:00
The server was shut down to prevent further damage. [1]
2020-07-13 13:20
Officers from the Kawasaki police station and Kanagawa police visited, and the company explained the situation. [1]
2020-07-14 18:00
The company reported to the Personal Information Protection Commission and IPA, and to the Ministry of Economy, Trade and Industry at 18:30. [1]
2020-07-16 15:38
Public disclosure. [1] [2]

Impact

All data on the websites of Johnan Yobiko DUO, Johnan Kobetsu and other services may have been lost. Names, addresses, phone numbers, schools, school years, birth dates, gender and email addresses in 34,263 records of people who asked for brochures or trial lessons through the sites since April 2016 may have leaked. Grades, passwords and bank or card data were not included. [1] [2] [4]

Response

The company posted notices from another server, said it would rebuild the sites on a replacement server and promised stronger monitoring and regular vulnerability tests. [1]