JNTO: a settings flaw in an outside cloud information system left 49,774 items on supporting organizations, members and contacts open to third parties
From August 25, 2015 to January 12, 2021, part of the data could be reached by third parties. It held no bank account numbers, card numbers or ID documents.
Disclosed
2021-01-21
Organizations involved
1
Leaked or at risk
49.8K
49,774
Downtime
Unknown
What happened
Impact
The data that may have been accessed came to 49,774 items, including information on supporting organizations, members and their contacts. It held no bank account or credit card numbers of companies or individuals and no personal ID documents, and no damage had been found. [1] [2]
Nikkei xTECH found through its own inquiry that the system uses a Salesforce service. [2]
Timeline
- Started 2015-08-25
- Detected 2021-01-12
- Disclosed 2021-01-21
- 1976 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
–
Organizations involved
[Breached][Major]Tokyo, ShinjukuOther services49,774 leaked
Japan National Tourism Organization
Sources
- [1][News]日本政府観光局、情報管理システムの設定変更、外部侵入の恐れから、被害の確認なしTravel Voice · 2021-01-22
- [2][News]セールスフォース製品「設定不備」による不具合続々、バンダイや日本政府観光局でもNikkei xTECH · 2021-02-01
- [3][News]セールスフォース設定不備、バンダイや政府観光局でもNikkei · 2021-02-02