Fujitsu: its project information sharing tool ProjectWEB was accessed without authorization and information entrusted by customers was stolen, including data of the Cabinet Secretariat, MLIT, MOFA and Narita International Airport

1. 2021-05-06

   Fujitsu noticed that ProjectWEB might have been accessed without authorization. It also gave the Ministry of Foreign Affairs its first report on the same day. [5] [10]

2. 2021-05-14

   Fujitsu gave the Ministry of Land, Infrastructure, Transport and Tourism its first report in the evening. [9]

3. 2021-05-17

   Fujitsu found access logs it did not recognize. It reported to Narita International Airport the same day that information on the airport's flight information management system had probably leaked. [6]

4. 2021-05-20

   Narita International Airport announced that information might have leaked. [4] [6]

5. 2021-05-24

   The National center of Incident readiness and Strategy for Cybersecurity warned government bodies and critical infrastructure operators to check whether they used similar tools. [7]

6. 2021-05-25

   Fujitsu announced the case and stopped all ProjectWEB projects. [1] [4] [5]

7. 2021-05-26

   The Ministry of Land, Infrastructure, Transport and Tourism and the Ministry of Foreign Affairs announced leaks reported by Fujitsu. The National center of Incident readiness and Strategy for Cybersecurity also said information on some of its systems had leaked. [2] [3] [8] [9]

8. 2021-05-27

   The Chief Cabinet Secretary said at a press conference that no leak of government information had been confirmed beyond the three bodies already announced. [11]

9. 2021-06-03

   The National center of Incident readiness and Strategy for Cybersecurity (NISC) said the leaked information included names and positions of participants in an information sharing exercise it ran, about 170 people from 90 government bodies and private companies. It said no information seriously harmful to cybersecurity was included and that the people concerned had been told. The investigation was not finished. [12]

10. 2021-06-16

    Fujitsu went back through past logs and reported to the Ministry of Internal Affairs and Communications that information related to an information system the ministry had commissioned had leaked. It includes the names, phone numbers and email addresses of ministry staff. The ministry had been told in late May that no leak was confirmed. [13] [14]

11. 2021-06-28

    The National Printing Bureau announced that information including materials it had provided leaked via another body it shares information system work with. It confirmed that no information on the manufacture or anti-counterfeiting of banknotes was included, and no damage from misuse was confirmed. [15]

12. 2021-08-11

    After investigation and analysis, it announced that part of the information stored in the tool had been viewed or downloaded without authorization for 129 customers. It was information on customers' system equipment and project management materials, and some included names and email addresses of customers and related people. The third party got in with legitimate IDs and passwords through normal authentication, and exploitation of some vulnerability in the tool is highly likely. A verification committee of outside experts will be set up. [16] [17]

13. 2021-09-24

    It published a third report. A dedicated CISO and a deputy CISO will be appointed from October 1 and the information security structure rebuilt. A verification committee of outside experts is examining the cause and the response. [18]

14. 2021-12-09

    It published a fourth report and said it would end ProjectWEB and move to another tool. [19] [20]

15. 2022-02-17

    It confirmed information leaks at 13 more customers. [22]

16. 2022-03-07

    It published a fifth report saying the number of affected customers had risen from 129 to 142. [21] [22]

17. 2022-04-22

    It published a sixth report. The verification committee report received on March 28 named causes including an insufficient information protection system, resource constraints on ProjectWEB, no immediate detection, and tenant management left to tenant administrators. The president and vice president voluntarily returned 10% of their monthly pay for one month. [23]

ProjectWEB is an online tool Fujitsu uses to run projects such as system development among its own staff, group companies, partners and customers, mainly to manage processes, source code and tasks. The number of projects and customers was not disclosed. The Nikkei reported that around ten customers were confirmed to have had information leaked. [4] [5]

At the time of Fujitsu's announcement, the cause of the unauthorized access and the contents of the leaked data were still under investigation. [1] [5]

• Ministry of Land, Infrastructure, Transport and Tourism: the leak included information on equipment making up its systems, staff email addresses and mailing list registrations that include people outside the ministry, at least 76,000 email addresses and the like. No unauthorized access to the ministry systems whose equipment data leaked was confirmed. [2] [9]
• Ministry of Foreign Affairs: study material for realizing digital government leaked, including personal information of 63 people, some staff and outside parties. It held no information on systems in operation. The access appears to have taken place around the end of April. [3] [10]
• National center of Incident readiness and Strategy for Cybersecurity (Cabinet Secretariat): information on some of its systems leaked. No unauthorized access to its systems themselves was confirmed. [8]
• Narita International Airport: documents on the specifications and operation of its flight information management system were downloaded. That system is not connected to the internet, and no sign of unauthorized access to it was found. [4] [6]

The fifth report raised the number of customers whose information leaked from 129 to 142. The 13 added customers were identified on February 17, 2022. [21] [22]

ProjectWEB had several vulnerabilities, but the one exploited could not be identified. A third party obtained valid IDs and passwords and accessed it from outside; there was no multi-factor authentication and detection was weak. Fujitsu ended the use of ProjectWEB and is moving to external software. [19] [20]