[Contained][Severity: Major][Credential abuse][Web app exploit]

Keio University: intrusion into Shonan Fujisawa Campus systems may have leaked 18,636 student photos and more, delaying the start of classes by a week

IDs and passwords of 19 staff were stolen and a flaw in the course system was exploited. Data on 5,088 students, 18,636 student photos and teachers' home addresses may have leaked.

Disclosed

2020-10-01

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-09-15
In the evening, the IT staff spotted suspicious access to the campus network system SFC-CNS. Checks showed repeated probing of the course support system SFC-SFS for flaws. The next day all users were asked to change passwords, logins from outside were limited to key authentication, and flawed web services were stopped and fixed. [4]
2020-09-28
At night, suspicious access to SFC-SFS was found, and early on the 29th it became clear that data might have leaked. SFC-SFS was shut down at 22:30 on the 29th. [4]
2020-10-01
The university disclosed a possible intrusion and pushed back the autumn term for two faculties and one graduate school from October 1 to October 8. [1] [2]
2020-11-10
The university published its findings: a series of intrusions, mainly from late August to September, had hit servers across the university, and personal data might have leaked from the SFC systems and a web server of the business school. [3] [4]

Impact

Data	Records
Student names, ID numbers, campus mail addresses and affiliations	5,088
Student ID photos submitted at entry	18,636
Records of credits earned	4,493
Teacher names, affiliations and positions	2,276
Teacher mail addresses, syllabus system passwords and birth years	2,276
Teacher home addresses	193
Names and mail addresses of staff and contractors	233

[4]

Mail of some of the 19 hijacked users and data in the home directories of all 19 may also have been read. On the business school server, group member lists and similar files may have leaked. [3] [4]

Cause and response

SFC-CNS IDs and passwords of 19 staff were stolen somehow and used to get in, and a flaw in an SFC-SFS web service was exploited. How the credentials leaked was still under investigation. [4]

The university set up a CSIRT on November 1, began checking web applications and systems across the university and reviewing how it handles personal data, and reported the case to the police and authorities. [3] [4]