> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Aichi Cancer Center: a doctor's cloud account was accessed without authorization, and emails with data on 183 patients may have leaked

A doctor's account was accessed from abroad, and emails with unprotected attachments holding data on 183 patients may have leaked.

Disclosed

2021-09-08

Organizations involved

1

Leaked or at risk

183

183

Downtime

Unknown

What happened

  1. From this day until July 14, the doctor's account was accessed from abroad. [1]

  2. A doctor made a report to the center. [1]

  3. The password was changed. [1]

  4. The access from abroad was found and the account was stopped. [1]

  5. The password was reset and multi-factor authentication was introduced. [1]

  6. It announced the case. [1]

Information that may have leaked

Information on 183 patients, included in emails with unprotected attachments, may have been seen. [1]

Timeline

  1. Started 2021-05-31
  2. Detected 2021-07-15
  3. Disclosed 2021-09-08
  4. 100 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][Health data]

Organizations involved

Open in organization search

Sources

  1. [1][Official]愛知県がんセンター職員が利用するクラウドサービスへの不正アクセスによる個人情報漏えいのおそれについてAichi Cancer Center · 2021-09-08