JAMSTEC: an attacker posing as staff connected over VPN and stayed in its core network for about a year, leaking 1,949 account records and mail addresses of 8,487 outside people

1. 2020-03-27

   According to the December report, unauthorized access to the internal network went on from this day. [5]

2. 2021-03-08

   Names, employee numbers, accounts, mail addresses and 1,947 hashed passwords of staff were stolen. [1] [4]

3. 2021-03-16

   A notice from the contractor that monitors the network revealed the access. The institution stopped all VPN connections and reported to the police. [1] [5]

4. 2021-03-18

   The institution disclosed the case. [1] [2] [3]

5. 2021-12-10

   It reported the results of its investigation, and had apologized by mail to the outside people affected by December 10. [5]

At the time of the March announcement, what was confirmed stolen was staff names, employee numbers, accounts, mail addresses and 1,947 hashed passwords. [1] [4]

The December report listed what the attack, which lasted about a year, had taken: 1,949 account records of staff, 219 files such as seminar manuscripts, 16 emails that were read illegally (with attachments in 4 of them), and a list of emails sent outside, including the addresses of 8,487 people outside the institution. No highly confidential data was found and there was no secondary damage. [5]

The institution explained that publication took time because it examined the scope of the leaked data with outside experts. [5]