Osaka University: the reservation system for its on-campus lodgings was accessed without authorization and its database erased; no trace of a leak of data of 43,213 users was found

1. 2020-12-01

   On a tip from a contracted security firm, the university found that the server of its on-campus lodging reservation system (RRS) had been accessed from outside. The same day it cut communication to the server and stopped the system. [1] [4]

2. 2020-12-09

   The university announced the possible leak of personal data. [1] [2] [3]

3. 2021-02-24

   By this day, the results of an outside firm's check of the access logs were known. The database of the system had been erased through the unauthorized access. [5]

The data that may have leaked is what users entered when booking, for 43,213 people in 46,630 records, from the system's launch in April 2017 to December 1, 2020. According to Nikkei xTECH it includes names, birth dates, phone numbers, addresses and mail addresses, and covers users of 15 on-campus lodgings and dormitories. No secondary harm was confirmed. [1] [3] [4]

When the outside maintenance firm checked the damage, the database that held the personal data had been deleted. The system had had its OS updated in mid-November and had only just been published in late November, and a flaw created by the update may have led to the intrusion. The cause was under investigation. The university is notifying users whose contact details it holds. [1] [4]

A check of the access logs, including the period before the system went live in April 2017, found traces of the operation that erased the database but none of data being downloaded or of a backdoor being installed. The system is down, and reservations for on-campus lodgings are handled by hand. A backup of the erased database exists, but this system will not be restarted and a new system is under consideration. [5]