> JapanHacked_
[Resolved][Severity: Major][Misdelivery][Misconfiguration]

Ohara Gakuen: a roster of 1,106 trainees of a training project entrusted by the Ministry of Health, Labour and Welfare was kept in the cloud against the specification, and an email with its URL was mistakenly sent to one applicant

An internal email with the URL of a 1,106-person roster of names, birth dates, addresses and phone numbers went to one applicant by mistake. It was deleted with no secondary use.

Disclosed

2021-08-26

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From this day, it kept the trainee roster in the cloud, against the method set in the specification of the entrusted project. [1]

  2. An internal email was mistakenly sent to one training applicant. It carried a URL to a file sharing service on the internet without security. The same day it apologized to the applicant, asked for deletion and confirmed no secondary use. [1]

  3. The Ministry of Health, Labour and Welfare announced the case. [1]

Impact and response

The file sharing service held a roster of 1,106 trainees including names, birth dates, addresses and phone numbers. The school apologized to all 1,106 people on the roster. The ministry cautioned and instructed the school and will audit information security. [1]

Timeline

  1. Started, Detected 2021-06-25
  2. Disclosed 2021-08-26
  3. 62 days

Attack or cause

Method
[Misdelivery][Misconfiguration]
Impact
[Data leak]
Entry point
E-mail

Data exposed or at risk

[Name][Date of birth][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][News]厚生労働省委託先の大原学園で仕様書に反するクラウドでの不適切な名簿管理、誤送信で発覚ScanNetSecurity · 2021-08-30 09:00