> JapanHacked_
[Resolved][Severity: Moderate][Misconfiguration]

Asahi Shimbun Social Welfare Organization: a third party could access the cloud donor management system, and data on four donors was viewed

The cloud donor management system could be reached by a special method, and addresses and donation amounts of four donors were viewed.

Disclosed

2021-03-02

Organizations involved

1

Leaked or at risk

4

4

Downtime

Unknown

What happened

  1. The organization announced the case. It had found in January that the cloud donor management system could be accessed by a third party using a special method, and had fixed it at once. Its investigation found that data on four donors had been viewed illegally. [1] [3]

Impact

Data on 4 donors was viewed: registration date, name, payment date, amount, payment method, postal code, address, phone number, email address and logs. No credit card data was included. [1]

The organization explained the situation to the four people and apologized. [1]

Timeline

  1. Disclosed 2021-03-02
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]クラウド型顧客管理システムへのセキュリティ対応についてAsahi Shimbun Social Welfare Organization · 2021-03-02
  2. [2][News]寄付者の個人情報に外部アクセス - 朝日新聞厚生文化事業団Security NEXT · 2021-03-10
  3. [3][News]朝日新聞厚生文化事業団の顧客管理システムに不正アクセス、寄付者の個人情報が閲覧ScanNetSecurity · 2021-03-10 08:00