Tokyo Metropolitan Government: a flaw in its vaccine reservation system for health workers let outsiders view data on 270,000 registered people with a certain operation, and it was stopped after one day

1. 2021-04-26 09:00

   The Tokyo government began operating the website "vaccine reservation system", which takes bookings from health workers and others. [1]

2. 2021-04-27 01:30

   Around this time, an outside party pointed out that personal information could be viewed, and the problem came to light. [1]

3. 2021-04-27 02:00

   The government contacted Digital Garage, which develops and runs the system, and stopped public access. [1]

4. 2021-05-11

   The system was reopened after security measures were put in place. [2] [3]

5. 2021-05-24

   Tokyo announced the results of its investigation. The system had been accessed several times from outside, including by the person who reported the flaw. The name, birth date, occupation and reservation number of 500 of about 270,000 people may have been viewed. The 500 were notified by letter, and no secondary damage has been confirmed. [2] [3]

With a tool used by developers and a certain operation, outsiders could see the names, birth dates, occupations and vaccination voucher numbers of people who booked. The system held data on 270,000 health workers scheduled for vaccination. [1]

The government investigated whether the data had been accessed from outside, suspended the system until it was fixed and kept taking bookings at its call center. A separate fault was also found that let the call center book slots that did not actually exist. [1]