[Resolved][Severity: Major][Credential abuse]

Matsuyama City: someone logged into the sports information site Sporting City Matsuyama.com with an administrator ID and password, posted without permission and viewed the contact details of 20 people

Unauthorized posts appeared on December 31, 2020. A third party logged in as an administrator and also viewed a list of the names and contacts of 20 registered people.

Disclosed

2021-01-12

Organizations involved

Leaked or at risk

Downtime

Unknown

What happened

2020-12-31
Unauthorized posts were made on the site. [1]
2021-01-06
The city noticed the unauthorized posts and found on investigation that the site had been accessed without authorization. [1]

Impact and response

The third party logged in with the administrator ID and password, made unauthorized posts and opened a page listing the names, phone numbers and mail addresses of 20 people registered on the site. [1]

The city explained and apologized to those whose data was viewed, tightened access restrictions and consulted the police about what to do next. [1]