> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Keio University: the meeting room reservation system of its Shonan Fujisawa Campus graduate building was accessed without authorization, and 6,507 personal data entries of people who booked may have leaked

A flaw in the meeting room reservation system was exploited, and 6,507 entries including names, phone numbers and email addresses of people who booked may have leaked.

Disclosed

2021-05-10

Organizations involved

1

Leaked or at risk

6.5K

6,507

Downtime

Unknown

What happened

  1. From this day, similar unauthorized access took place. A later log investigation showed similar attacks on November 6 and on December 2, 16 and 17. [1]

  2. The server was accessed without authorization. [1]

  3. Around this time, the university noticed that the reservation system display was garbled, investigated and found the unauthorized access of April 12. [1]

  4. It began contacting the people concerned individually. [1]

Impact

Names, phone numbers, email addresses, affiliation codes and the like, 6,507 entries in total, of people who made reservations between December 20, 2013 and April 12, 2021 may have leaked. Without duplicates that is 552 names, 505 phone numbers and 609 email addresses. The university reported the damage to its supervising ministry. [1]

Timeline

  1. Started 2020-11-05
  2. Detected 2021-04-14
  3. Disclosed 2021-05-10
  4. 186 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]会議室予約システムに不正アクセス、予約者情報流出の可能性 - 慶大Security NEXT · 2021-05-10