> JapanHacked_
[Resolved][Severity: Moderate][Misconfiguration]

Niigata Prefecture: construction drawings published in its bid information service showed the names of 16,561 landowners and contractor staff

After landowners' names were found on drawings from one regional office, a prefecture-wide check found names of 16,561 people in total on published drawings.

Disclosed

2020-07-22

Organizations involved

1

Leaked or at risk

16.6K

16,561

Downtime

Unknown

What happened

  1. Staff at the Murakami regional office noticed the names of 14 landowners on construction plans in the bid information service. A check of all its projects found 170 names. [2]

  2. The prefecture issued a press release, with a follow-up on August 6. [1]

  3. The prefecture published the results of a check across all departments using the service. [1] [3]

Impact

Names of nearby land and building owners appeared 8,763 times on 722 drawings, and names of supplier staff 7,798 times on 958 drawings. The prefecture removed the names, apologized to those affected, and said drawings would be republished only after personal data was removed. [2]

Timeline

  1. Detected 2020-07-21
  2. Disclosed 2020-07-22
  3. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「入札情報サービス」への掲載に関する不適正事案に係る全庁調査の結果についてNiigata Prefecture · 2020-09-11
  2. [2][News]入札情報の公開データに個人情報、のべ1.6万人分 - 新潟県Security NEXT · 2020-09-14
  3. [3][News]まさに「おつかれさま」9万件のPDFの次は工事図面の全庁調査実施（新潟県）ScanNetSecurity · 2020-09-17