> JapanHacked_
[Resolved][Severity: Major][Ransomware][Web app exploit]

Saito City: data on the city website was deleted and a ransom note left, and 973 contact form entries may have leaked

A flaw in an old-site guide page let attackers into the admin tool. Contact form entries since April 2017 from 793 individuals and 180 businesses may have been stolen.

Disclosed

2020-11-13

Organizations involved

1

Leaked or at risk

973

973

Downtime

Unknown

What happened

  1. Around this time, the city website was broken into and its data deleted. An English note demanded payment in Bitcoin in exchange for restoring the data. [1]

  2. In the morning, staff noticed the site could not be viewed, and the contractor investigated. The site was restored from backups. [1]

  3. It emerged that data may have been stolen. [1]

  4. The city apologized by mail to the people concerned and warned them about suspicious contact. [1]

Impact

Data from 793 individuals and 180 businesses who used the contact form from April 1, 2017 to November 7, 2020 may have been stolen. It includes names, mail addresses, opinions and requests, and the addresses and phone numbers some people added. [1]

Cause and response

The site was renewed in 2017, but a guide page for users of the old site still had a flaw, and it was used to get into the administrator tool. The city consulted the police and fixed the flaw. [1]

Timeline

  1. Started 2020-11-07
  2. Detected 2020-11-09
  3. Disclosed 2020-11-13
  4. 6 days

Attack or cause

Method
[Ransomware][Web app exploit]
Impact
[Data leak][Service outage][Extortion]
Entry point
Web app

Data exposed or at risk

[Name][E-mail address][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][News]西都市のウェブサイトがランサム被害 - 個人情報流出の可能性Security NEXT · 2020-11-16