Ryobi Systems: a permission error in its resident apps and emergency call system for local governments led to confirmed outside access at 13 of the 71 bodies using them

1. 2020-11-08

   From this day until November 25, Nagahama City's child-rearing support app Nagamaru Kids! saw 133 connection attempts, failed ones included, and in 45 of them the database was entered and data was read. [8]

2. 2020-12-29

   In the latter half of 2020, settings flaws in Salesforce came to light at several companies. The company studied the warnings and countermeasures and discussed the impact with Salesforce, but judged that no settings change was needed. [5]

3. 2021-01-09 20:23

   At Higashimurayama City's disaster prevention app, 219 unauthorized accesses and 100 data lookups took place from 20:23 until 13:19 on January 14. [7]

4. 2021-01-13

   At Kobe City's KOBE Post, there were 5 connections, failures included, and 4 data retrievals between just before 22:00 and just before 4:30 on January 14. [1]

5. 2021-01-13 21:51

   At Net119 used by Niigata City and the Iida wide-area fire headquarters, unauthorized access by a third party took place from 21:51 until 4:19 on January 14. [6]

6. 2021-01-20

   Higashimurayama City, after a warning from the National center of Incident readiness and Strategy for Cybersecurity, told the company on this day and on January 22 to check the situation. [7]

7. 2021-02-01

   The contractor confirmed unintended access by outside third parties and noticed the flaw. It changed the settings the same day and cut off outside access. [1] [2] [4]

8. 2021-02-02

   The setting behind the problem was corrected for Net119 at Niigata City. [6]

9. 2021-02-08

   The company reported the case to Kobe City and Takasago City. [1] [2]

10. 2021-02-10

    The company announced that it had confirmed access by outside third parties to its systems for local governments. Nine local governments, including Kobe and Higashimurayama, announced a possible exposure around the same time. [3]

11. 2021-02-12

    The company announced that it had confirmed unintended access by outside third parties at 13 of the 71 bodies. [4] [5]

12. 2021-02-15

    Higashimurayama City announced the unauthorized access to its disaster prevention app. [7]

13. 2021-02-16

    Niigata City and the Iida wide-area fire headquarters announced the unauthorized access to Net119. [6]

14. 2021-04-23

    Nagahama City announced that personal information might have been read through Nagamaru Kids!. [8]

The affected services are the resident life support app i-Blend, the emergency call system Net119 and the Web resident health checkup booking, which the company provides to local governments on Salesforce cloud services. 71 bodies use them, and registered data was set up so that outsiders could view it unintentionally. The company explained the cause as a wrong permission setting that came from its own misjudgment about outside reference settings. [4] [5]

The table lists the service users of the nine local governments that had announced a possible exposure by February 12; they are not the number of people affected. [3]

KOBE Post started in April 2019 and had 12,157 registrants as of February 1, including 5,061 members of the Kobe City net monitor panel. Takasago Navi started in January 2020 and had 8,367 registrants. Takasago found no access in its logs from January 3 to February 2. [1] [2]

Higashimurayama's app had 10,620 registrants as of February 1 and held user IDs, names, residential areas, mail addresses and optional gender. The count of data lookups includes failed searches. At Niigata City's Net119, the registered data (address, name, birth date, gender, phone number, mail address and more) of 47 of 291 registrants may have been viewed. The Iida wide-area fire headquarters wrote to all registrants by February 15 with an apology and a warning. [6] [7]

Nagahama City in Shiga also announced, on April 23, that a third party might have read data in its child-rearing support app Nagamaru Kids!, because of the same kind of Salesforce setting flaw in the system the company runs for it. An analysis of the access logs from the launch in February 2018 to February 12, 2021 showed that 100 records may have been read, but only 2 held personal information (name, address, email address and phone number) and the rest held only nicknames and the like. The app had 3,948 registrants at the end of March 2021. The city apologized individually to the two people whose data may have been read. [8]