EPARK: a cache fault after adding a feature to its reservation site showed names, reservation history and other data of some members on other members' screens, up to 4,949 records
A fault from a feature addition showed some members' information on other members' screens, up to 4,949 records.
Disclosed
2021-05-31
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
Impact
The problem came to light from a customer's phone call around noon. The data that may have been shown wrongly is, at most, 3,755 records in the name and nickname part, 4,949 records on the reception status and reservation history screens, and 1,228 and 74 records on other screens. Names and phone numbers may have been shown for up to 163 records. [1] [2]
Timeline
- Started, Detected 2021-05-26
- Disclosed 2021-05-31
- 5 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Services hit
Organizations involved
[Breached][Moderate]Tokyo, MinatoInformation and communications4,949 leaked
EPARK, Inc.
Sources
- [1][News]予約サイト「EPARK」で別会員情報を誤表示 - キャッシュ処理で不具合Security NEXT · 2021-06-09
- [2][News]EPARKサイトで他の会員情報が誤表示、機能追加に伴う障害が原因ScanNetSecurity · 2021-06-16 08:00