Saga City: 986 images sent through the inquiry form of the city website could be viewed by anyone who knew the URL because the contractor did not restrict access

1. 2021-02-25 18:35

   An outside person informed the secretary division through the "inquiries to departments" form of the site that the images were viewable. [2]

2. 2021-02-26

   The city confirmed the report. The contractor restricted access to the image folder, backed up the files and deleted them. The city reported to the Ministry of Internal Affairs and Communications and Saga Prefecture. [1] [2]

3. 2021-03-01

   The city reported the flaw to the senders, apologized and told them the contact point from now on. [2]

4. 2021-03-02

   The city announced the case. [2]

The images that could be viewed numbered 986. 123 of them contained personal data: 4 My Number cards, 2 notification cards, 2 driver's licenses, 2 passports and 113 application forms and similar. The other 863 were landscape and flooding photos, illustrations and the like, with no personal data. [1] [2]

The function to attach images to the mail forms was added during the October 2019 renewal of the site, and the images were stored on the server as files with random names and sent to the departments together with the mail body. The cause was that the city had told the company managing its website to keep third parties out of the image folder, but this was not done and the city had not checked. The images were accessed 982 times from three IP addresses, all confirmed to be those of the person who reported the problem. [2]

The city will write into its outsourcing contract rules that data must not be kept, write protection measures for users' personal data into development specifications, and thoroughly check security. [2]