> JapanHacked_
[Resolved][Severity: Moderate][Misconfiguration]

Konami Digital Entertainment and Konami Amusement: a misconfigured cloud customer management system let outsiders view email addresses and phone numbers of 35 customers

A misconfigured external cloud customer management system exposed login IDs and email addresses of 35 customers to outsiders.

Disclosed

2021-03-01

Organizations involved

2

Leaked or at risk

35

35

Downtime

Unknown

What happened

  1. An outside party pointed out a misconfiguration in an external cloud customer management system. The companies changed the settings at once and began an investigation. [1] [2]

  2. The companies announced that a third party had accessed part of the data. [1] [2]

Impact

35 people were confirmed to have been accessed: 28 at Konami Digital Entertainment (5 login IDs, 19 email addresses, 9 phone numbers) and 7 at Konami Amusement (6 login IDs, 5 email addresses, 7 phone numbers); the counts overlap. [1]

Names and addresses tied to the login IDs are kept in a different system and are not considered leaked. The companies declined to say how long the misconfiguration lasted or how often the data was accessed. [2]

The companies contacted the customers concerned one by one and reported the case to the supervising authority. [1] [2]

Timeline

  1. Detected 2021-01-04
  2. Disclosed 2021-03-01
  3. 56 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[E-mail address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][News]クラウド型顧客管理システム設定不備、コナミグループへ不正アクセスScanNetSecurity · 2021-03-04 08:00
  2. [2][News]「Salesforce」のアクセス権限設定で不備 - コナミ関連2社Security NEXT · 2021-03-05