> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Lifie: an intrusion into its insurance comparison site system may have leaked up to 88,564 customer records

A system flaw was exploited to break into the database. Names, addresses, phone numbers, birth dates and mail addresses are affected, and some records include medical history.

Disclosed

2020-10-29

Organizations involved

1

Leaked or at risk

88.6K

88,564

Downtime

Unknown

What happened

  1. The company confirmed that the system managing customer data had been attacked through its website. [2]

  2. Analysis of access logs showed that personal data might have leaked. [2]

  3. The company disclosed the case. [1]

  4. It published the findings of an outside investigation and judged that up to 88,564 records had leaked. [2] [3]

Impact

Group
Records
Data
People who requested brochures on the site, or who met, mailed or phoned staff
up to 88,111
Name, address, phone, birth date, mail address, contact history
Of these, people whose history includes medical history
up to 348
Same, plus medical history
Some people who took out insurance through Lifie in January and February 2017
up to 105
Name, policy number, insurer, insurance type, premium
[2]

Because the leaked records could not be identified, the company judged that all customer data in the attacked file, up to 88,564 records, had leaked. [2]

Timeline

  1. Detected 2020-10-13
  2. Disclosed 2020-10-29
  3. 16 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Phone number][Date of birth][E-mail address][Health data]

Organizations involved

Open in organization search

Sources

  1. [1][News]不正アクセスで保険契約情報など顧客情報流出の可能性 - 保険代理店Security NEXT · 2020-11-02
  2. [2][News]調査結果：保険代理店業務受託会社 顧客管理システムへの不正アクセス、最大88,564件の個人情報流出ScanNetSecurity · 2020-12-09 08:00
  3. [3][News]不正アクセスで顧客情報約8.8万件が被害か - 保険代理店Security NEXT · 2020-12-10