freee: a permission flaw in its Salesforce-based inquiry forms left 2,898 inquiries open to outsiders for over a year

1. 2020-01-29

   From this day, a permission flaw in an outside cloud inquiry management system left part of the inquiries open to third parties. [1] [2]

2. 2021-02-08 22:00

   Around this time, after a warning from an outside expert, the company confirmed that the data was open to third parties. [1] [2]

3. 2021-02-09

   It changed the settings so that third parties could no longer reach the data. [1]

4. 2021-02-10

   The company disclosed the case. [1] [2]

5. 2021-03-01

   It announced that log analysis and other checks found no unauthorized access and no leak. [3]

The exposed data were the 2,898 first inquiries to the account reset request form, the pricing and payment inquiry form and the recruiting inquiry, all of which can be used without logging in. The text held 2,898 mail addresses, 1,744 names, 794 phone numbers, 7 addresses, 3 bank account numbers, 2 credit card numbers, 2 IDs and passwords for services other than freee and 1 freee login ID and password. [1] [2]

The company said its accounting and HR services had no such problem. In a follow-up on March 1 it said there was no unauthorized access and no effect on users. [1] [3]