White Plus: intrusion into the server of the house cleaning matching site Kirehapi may have exposed 9,480 customer records

The attacker was able to use a system administrator account and could reach customer names, addresses, phone numbers and bookings.

Disclosed

2020-10-20

Organizations involved

Leaked or at risk

9.5K

9,480

Downtime

Unknown

What happened

2020-10-11
From 3:28 to 11:06, the attacker could reach customer data with an administrator account. The company noticed the server behaving oddly and found traces of the intrusion while repairing it. [1]
2020-10-11 03:30
At about this time an error alert came in and the site became unreachable. It was restored at 11:06, and the intrusion was confirmed at 11:33. The company recreated its authentication key and closed the path used to get in. [2]
2020-10-12
The company filed a report with the police. [1]
2020-10-13
It reported the case to the Personal Information Protection Commission and IPA. [1]
2020-10-20
The company disclosed the case and said that, so far, it had found no trace of customer data being taken with the administrator account. [1]

Impact

Registration data of 9,480 customers who had used the site by about 11:06 on October 11 may have leaked: names, addresses, phone numbers, mail addresses, bookings and messages with cleaning firms, plus gender, birthday and profile picture for customers who posted reviews. [1]