Hoyu: an access-permission misconfiguration in its cloud customer management system let outsiders reach its customer service data, and the data of one person leaked

1. 2020-11-08

   Later investigation found that unauthorized access happened several times from this day until February 8, 2021. [4]

2. 2021-02-16 20:00

   The system's agent ran a check and found a flaw in the access-permission settings of the cloud customer management system (Salesforce). By 22:00 it was clear that 3,109 records created under past settings were at risk. [2] [3]

3. 2021-02-17

   The agent reported to Hoyu at 9:30. At 19:15 the agent corrected the settings of the 3,109 records. [2] [3]

4. 2021-02-18

   The agent reported to Hoyu that the settings had been corrected. [2]

5. 2021-02-26

   The company published a preliminary report. [1] [2]

6. 2021-05-24

   The company published its final report. [4]

The data covered names (in kana), addresses, phone numbers and email addresses of customers who had contacted the customer service desk. Outsiders may have reached it between November 20, 2017 and February 17, 2021. The access logs of the past 30 days showed 22 accesses from outside, but no leak was confirmed at first. [2] [3]

The final report found, after examining all access records from the system's management company, that one of the unauthorized accesses leaked the data of one person. The investigation had started with 3,109 records, but because all of the company's data could have been targeted, 109,846 records were checked. No leak of other customers' data was found, and the person concerned was contacted directly. [4]