[Resolved][Severity: Major][Misconfiguration]

Kawasaki City: a COVID-19 patient list for 2,515 people was posted with non-public fields

At about 15:00 on November 22 the city posted a list with hospitals, testing clinics and presumed sources of infection, and fixed it before 16:00 after a call.

Disclosed

2020-11-24

Organizations involved

Leaked or at risk

2.5K

2,515

Downtime

Unknown

What happened

2020-11-22 15:00
At about this time, a list of 2,515 people who tested positive for COVID-19 was posted on the city site together with fields that are not normally published, including hospital, admission date, testing clinic, presumed source of infection and contacts. After a phone call pointed it out, the city corrected the list before 16:00. [1]