[Resolved][Severity: Critical][Web app exploit]

Japan Chemical Database: an SQL injection attack leaked 1,652 customers' personal records and 166 company records

An attack on a search function of a trial page leaked 1,652 personal records, including login passwords and email addresses.

Disclosed

2021-07-13

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2021-07-05
The company noticed the unauthorized access. [1]
2021-07-13
It announced the case and reported to the Personal Information Protection Commission and the police. [1]

Leaked information

The search function of a trial page suffered an SQL injection attack. 1,652 personal records of customers (login passwords, email addresses and more) and 166 company records leaked. [1]

Timeline

Detected 2021-07-05
Disclosed 2021-07-13
8 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[E-mail address][Passwords]

Organizations involved

[Breached][Critical]Tokyo, BunkyoInformation and communications1,652 leaked
Japan Chemical Database Co., Ltd.

						Note
Japan Chemical Database Co., Ltd.	[Breached]	[Critical]	Tokyo, Bunkyo	Information and communications	1,652

Open in organization search

Sources

[1][News]日本ケミカルデータベースにSQLインジェクション攻撃、個人情報1,652件が流出ScanNetSecurity · 2021-07-16 08:00