> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

JNTO: a settings flaw in an outside cloud information system left 49,774 items on supporting organizations, members and contacts open to third parties

From August 25, 2015 to January 12, 2021, part of the data could be reached by third parties. It held no bank account numbers, card numbers or ID documents.

Disclosed

2021-01-21

Organizations involved

1

Leaked or at risk

49.8K

49,774

Downtime

Unknown

What happened

  1. From this day, a setting of the cloud information system run outside the agency let third parties reach its data. [2]

  2. It became clear that part of the data could be reached by third parties. [1] [2]

  3. The agency disclosed the case. [2]

  4. It finished changing the settings to keep third parties out. [1]

Impact

The data that may have been accessed came to 49,774 items, including information on supporting organizations, members and their contacts. It held no bank account or credit card numbers of companies or individuals and no personal ID documents, and no damage had been found. [1] [2]

Nikkei xTECH found through its own inquiry that the system uses a Salesforce service. [2]

Timeline

  1. Started 2015-08-25
  2. Detected 2021-01-12
  3. Disclosed 2021-01-21
  4. 1976 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]日本政府観光局、情報管理システムの設定変更、外部侵入の恐れから、被害の確認なしTravel Voice · 2021-01-22
  2. [2][News]セールスフォース製品「設定不備」による不具合続々、バンダイや日本政府観光局でもNikkei xTECH · 2021-02-01
  3. [3][News]セールスフォース設定不備、バンダイや政府観光局でもNikkei · 2021-02-02