> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Qualitia: a product development contractor left 1,292 support mails viewable by anyone on an outside online service

Through a contractor employee's carelessness, support mails exchanged with customers were uploaded to an outside service where anyone could see them.

Disclosed

2020-10-20

Organizations involved

1

Leaked or at risk

1.3K

1,292

Downtime

Unknown

What happened

  1. Around noon, an employee of a contractor developing some features uploaded customer support mails to an outside online service in a state where anyone could view them. [1]

  2. At about 16:00, a user of that service pointed out the problem. [1]

Impact and response

1,292 mails including mail addresses and nicknames were viewable for a time. The company had the contractor take them down, and as of October 16 they could no longer be seen. It said it would contact the customers concerned. [1]

Timeline

  1. Started 2020-09-14
  2. Detected 2020-09-18
  3. Disclosed 2020-10-20
  4. 36 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[E-mail address][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]問合メールが流出、製品開発の委託先で - クオリティアSecurity NEXT · 2020-10-20