[Resolved][Severity: Critical][Misconfiguration]

PayPay: a permission misconfiguration on a merchant management server left merchant, agent and staff data open to access (up to 2,101 records)

A server holding sales data was open to outside access, and one connection came from Brazil. The company first said up to 20.08 million records, later corrected to 2,101.

Disclosed

2020-12-07

Organizations involved

Leaked or at risk

2.1K

2,101

Downtime

Unknown

What happened

2020-10-18
From this day, the access permissions for merchant sales information were set incorrectly. [1] [2]
2020-11-28
One access came from Brazil. [1] [2]
2020-12-01
After a tip from outside, the company began checking the server's access history. [1] [2]
2020-12-03
It blocked the access and corrected the faulty setting. [1]
2020-12-07
The company disclosed the case. [1] [2]

Impact

The data that could have been viewed covers merchants' shop names, addresses, contacts, representatives' names and birth dates, contract dates, payout accounts and sales contact records, information on sales targets, staff names and contacts, partners' and agents' contacts and payout accounts, and the names, phone numbers and mail addresses of merchant survey respondents. User data sat on a separate server and was not affected. [1] [2]

The first notice put the possible number of accessed records at up to 20,076,016. A closer analysis later corrected it to 2,101. No misuse of the information was confirmed. [1] [2]

The company is strengthening monitoring of access and of system changes on the merchant management system. [1]