[Resolved][Severity: Critical][Misconfiguration]

Yahoo Japan: a bug in Yahoo! JAPAN ID wrote users' profile edits into up to 387,460 other people's IDs

For about a week, edits to Yahoo! JAPAN ID profiles were saved to unrelated users' IDs, so names and addresses could be seen by others and goods could go to the wrong place.

Disclosed

2020-08-06

Organizations involved

Leaked or at risk

387.5K

387,460

Downtime

Unknown

What happened

2020-07-29 14:06
A bug began saving profile edits not to the user's own record but to the records of unrelated users. [1] [2]
2020-08-04 23:50
The bug lasted until about this time. [1] [2]
2020-08-06
Public disclosure. [2]

Impact

Edits may have been written to unrelated IDs up to 528,155 times, overwriting the profiles of up to 387,460 IDs. The fields included names, home, work and school addresses, phone and fax numbers and emergency contact numbers, and they landed on users who viewed their profile, shopped or signed contracts during that time. [1] [2]