[Resolved][Severity: Major][Intrusion]

Tokyo Gas: the website of its dating game Furo-koi was accessed without authorization, and mail addresses and nicknames of 10,365 web members leaked

The site was altered from the night of January 27 to the morning of the 28th, showing a link to an overseas adult site. Mail addresses and nicknames of members leaked.

Disclosed

2021-01-30

Organizations involved

Leaked or at risk

10.4K

10,365

Downtime

Unknown

What happened

2021-01-27 23:00
From this time the site was altered and began to show a link to an overseas adult site. [1]
2021-01-28
The alteration ended by 9:00. The company noticed the abnormal site the same day. [1] [3]
2021-01-29
In the evening, it became clear that member data had leaked. [1] [3]
2021-01-30
It disclosed the case, suspended the site and the app, and reported the damage to the Metropolitan Police. [1] [2] [4]
2021-04-26
It published the results of its investigation. [5]

Impact and findings

The leaked data were the mail addresses and nicknames of 10,365 web members. The company said it had found no sign that the data had been abused. [1] [3] [4]

The April 26 findings said what the site submitted for its security review when it launched differed from how it was actually run, and some servers did not reach the required security level. No other intrusion was found. The company planned to reopen the site on April 30. [5]