> JapanHacked_
[Resolved][Severity: Major][Misdelivery]

TECRA: an email to pre-registrants of its real estate crowdfunding service TECROWD showed 1,204 email addresses to all recipients

The recipient setting of an email inviting formal registration was wrong, so 1,204 pre-registrants' addresses were visible to all recipients.

Disclosed

2021-04-19

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The same day, the company apologized to the customers concerned by email and asked them to delete the email sent by mistake. [1]

  2. Shortly after 15:00, the company sent an email inviting pre-registered members of its crowdfunding products to register formally. The recipients' addresses were wrongly set as visible recipients, so the addresses of 1,204 people were visible to all recipients. [1]

Timeline

  1. Started, Detected 2021-04-01
  2. Disclosed 2021-04-19
  3. 18 days

Attack or cause

Method
[Misdelivery]
Impact
[Data leak]
Entry point
E-mail

Data exposed or at risk

[E-mail address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]不動産投資クラウドファンディングの事前登録者メアドが流出Security NEXT · 2021-04-19