RIKEN: its learning management system was accessed without authorization, and about 14,000 personal records may have leaked

1. 2021-09-24

   The provider reported that the learning management system had been tampered with. [1] [2]

2. 2021-09-27

   It informed those concerned through a notice on the intranet. [1]

3. 2021-10-07

   It notified again through an intranet notice. [1]

4. 2021-10-08

   It emailed outside users and retirees. [1]

5. 2021-11-05

   It announced the case. The system had been stopped, passwords reset and the service restored. [1] [2]

Files of the learning management system were altered and commands were run, so about 14,000 personal records may have leaked: ID numbers, names and email addresses. A known vulnerability that RIKEN had asked to be fixed was exploited. Those affected are RIKEN-related people as of September 24, 2021, retirees since March 16, 2019, and outsiders who have used the system since April 2020. [1] [2]