Sumitomo Mitsui Construction: a flaw in a contractor's external backup server let a third party view site data, some of it holding contacts' names and mail addresses

1. 2020-12-24

   Someone outside pointed out that company data seemed to be viewable from outside. The company shut down this backup system entirely the same day. [1] [2] [3]

2. 2021-01-25

   The company disclosed the case. [1] [3]

In one of several external systems used to back up site business data, the contractor's backup server had a flaw in its access filter. Part of the data in the backups of 41 site servers using the system was viewed by a third party, by methods such as specifying file locations at random. [1] [2] [3]

Some of the data viewed contained personal information such as names, mail addresses and mobile phone numbers of people involved. There was no credit card data. The company said there was no access after December 24, 2020 and it had received no reports of damage. [1]