> JapanHacked_
[Resolved][Severity: Critical][Misdelivery]

Bukkyo University: a spreadsheet with bank account details of 237 past grantees and vendors was attached by mistake to 92 emails guiding researchers on grants

On April 27 the emails sent to researchers carried an attachment holding unrelated personal data such as bank account numbers.

Disclosed

2021-05-14

Organizations involved

1

Leaked or at risk

237

237

Downtime

Unknown

What happened

  1. A staff member sent 92 emails guiding researchers who were subject to a Japan Society for the Promotion of Science research grant on administrative procedures. The attached spreadsheet held unrelated personal data, because the document had been made from a file used before. [1]

  2. The staff member who noticed the problem asked recipients to delete the emails, sent them again with a corrected file and reported to a superior. [1]

  3. It sent apology letters to the people concerned. It reported to the Personal Information Protection Commission and the Ministry of Education, Culture, Sports, Science and Technology. [1]

Impact

The file held names, vendors, bank names, branch names, account types, account numbers and account holder names of 143 researchers and research staff of the university who were 2011 grantees and 94 vendors. [1]

Timeline

  1. Started 2021-04-27
  2. Detected 2021-04-28
  3. Disclosed 2021-05-14
  4. 17 days

Attack or cause

Method
[Misdelivery]
Impact
[Data leak]
Entry point
E-mail

Data exposed or at risk

[Name][Bank account]

Organizations involved

Open in organization search

Sources

  1. [1][News]過去の助成対象者情報含むファイルを研究者などへ送信 - 佛教大Security NEXT · 2021-05-14