> JapanHacked_
[Resolved][Severity: Moderate][Misdelivery]

Osaka City: an error in preparing enrolled child lists for nursery facilities sent names, birth dates and other data of 3,692 unrelated children to 98 facilities

An error in preparing lists for nursery facilities sent names, birth dates and other data of 3,692 unrelated children to 98 facilities.

Disclosed

2021-06-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A nursery facility that received a list contacted the city, which revealed the problem. [1]

  2. Osaka City announced the case. [1]

Cause and response

The city had reduced nursery fees for the period in which parents cooperated by caring for children at home to prevent the spread of the coronavirus, and sent enrolled child lists to each facility to confirm attendance days for May. Staff prepared the lists for 773 facilities by hand from data output from the comprehensive welfare system, but a copy and paste error in the spreadsheet shifted facility names and child names at 98 facilities in the latter half of the list. The data covers 3,692 enrolled children, including names, birth dates and ages. [1]

The city explained the matter to the facilities concerned, apologized and is collecting the lists it sent. It planned to explain to the children and parents in writing with apologies. It said the enrolled child list was not something the system could output and was made ad hoc because of the pandemic, that a sudden manual process caused the error and that checking was insufficient. In future it will design the output to avoid manual processing and, where processing is done, have several people check. [1]

Timeline

  1. Detected 2021-06-01
  2. Disclosed 2021-06-04
  3. 3 days

Attack or cause

Method
[Misdelivery]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Date of birth]

Organizations involved

Open in organization search

Sources

  1. [1][News]大阪市、在籍児童名簿の作成でミス - 児童情報3692人分を異なる施設に送付Security NEXT · 2021-06-04