Advantage Risk Management: logs of the inquiry form of its employee assistance service Advantage EAP could be viewed from outside through a specific URL, covering 12,019 people

1. 2018-04-10

   When the inquiry form went live, an operator's settings mistake put the log output set up for testing in a place visible from outside. From this day the logs could be viewed by entering a specific URL. [1] [3]

2. 2021-01-26 11:15

   Neos, which provides the service together with the company and manages the system, noticed during maintenance work that the logs could be viewed from outside. By around this time the data had been moved to a place not visible from outside. [1] [2]

3. 2021-02-10

   The company disclosed the case. [1] [3]

The service is provided jointly by Advantage Risk Management, Tokio Marine & Nichido Medical Service and Neos. What could be viewed was the log of what had been typed into the inquiry form: 14,384 inquiries from 12,019 people. It held employer names, employee numbers, names, birth dates, mail addresses and the type and content of the inquiries, and some people had also entered phone numbers. [1] [2] [3]

The inquiry form ran on a separate system from the main service, so consultations were not affected. The company searched the internet for randomly chosen items and found no sign that the data had been published illegally. [1]