> JapanHacked_
[Resolved][Severity: Critical][Intrusion]

en Japan: its job posting service engage was accessed without authorization, all folders holding images and videos on a server were deleted, and the data could not be fully restored

Unauthorized access deleted every folder of images and videos, and they could not be fully restored. The servers holding personal information were not accessed.

Disclosed

2021-04-05

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A fault occurred that left the images of engage unusable. Outsiders had accessed the service without authorization and deleted all folders on the server that stored its image and video files. [1] [2]

  2. The company announced the case. It tried to restore the deleted data and found that a full recovery was not possible. [1] [2]

Impact and response

The servers that manage personal information were not accessed, and no leak of personal information has been confirmed. The company also ruled out an effect on its other services. It asked the companies using the service to check their images and videos and set them again if needed. [1] [2]

The company blocked outside access and said it would check the whole system, review its security measures, strengthen authentication, have a third party regularly review operations and back up all information regularly. It planned to file a damage report with the police. [1] [2]

Timeline

  1. Started, Detected 2021-04-02
  2. Disclosed 2021-04-05
  3. 3 days

Attack or cause

Method
[Intrusion]
Impact
[Service outage]
Entry point
Unknown

Data exposed or at risk

–

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]求人サービス「engage」に不正アクセス - 画像や動画が全消失Security NEXT · 2021-04-06
  2. [2][News]エン・ジャパン求人サービス「engage」に不正アクセス、画像 動画データ全削除ScanNetSecurity · 2021-04-07 08:00