> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

Chunichi Shimbun (contractor Landmarks): the server of the campaign entry sites of Tokyo Shimbun, Chunichi Shimbun and Hokuriku Chunichi Shimbun was accessed without authorization, and about 143,000 records of personal data were deleted and may have leaked

A contractor running the entry sites of three newspapers was accessed without authorization, and about 143,000 records of personal data were deleted. They may also have leaked.

Disclosed

2021-06-24

Organizations involved

2

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Around this time, Chunichi Shimbun was told by Landmarks Co., Ltd., which it had entrusted with running the campaign entry web pages Hot Web, that its server had been accessed from outside without authorization and the personal information stored on it had been deleted. [1] [2] [3]

  2. It reported to the Personal Information Protection Commission and announced the case. [1] [2] [3]

Information that may have leaked

Names, addresses, genders, age groups, newspaper subscription history, phone numbers and email addresses of people who entered campaigns of Tokyo Shimbun, Chunichi Shimbun and Hokuriku Chunichi Shimbun, about 143,000 records in total. The campaigns are four of Tokyo Shimbun from 2009 to 2019 (Hot Photo Column, Tokyo Hot Quiz, Tokyo Hot Photo Contest and the Tokyo Hot Web Prize Campaign), two of Chunichi Shimbun in 2015 and from 2016 to 2019, and the Hokuriku Hot Photo Contest of Hokuriku Chunichi Shimbun in 2016. [1] [2] [3]

Chunichi Shimbun recognizes that the data was not only deleted but may also have leaked. No concrete trace had yet been found. The date and cause of the unauthorized access were unknown, and the company is investigating including the possibility of a ransomware attack. Because the data was deleted, as of June 25 the people concerned and the counts per campaign were unknown, and it is checking the state of backups and the possibility of recovering the data. It set up a response team and told contractors such as Landmarks to strengthen security. [1] [2]

Timeline

  1. Detected 2021-06-23
  2. Disclosed 2021-06-24
  3. 1 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[Name][Postal address][Phone number][Gender][E-mail address]

Supply chain

Organizations involved

Open in organization search

Sources

  1. [1][Official]お客さま情報の流出の可能性に関するお知らせとお詫びThe Chunichi Shimbun Co., Ltd. · 2021-06-24
  2. [2][News]サイトの個人情報が不正削除、外部流出の可能性も - 中日新聞関連3紙Security NEXT · 2021-06-25
  3. [3][News]中日新聞の業務委託企業へ不正アクセス、キャンペーン応募情報が流出の可能性ScanNetSecurity · 2021-06-28 08:00