> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Yano Research Institute: its site was hit by SQL injection and up to 101,988 member records may have leaked

Its site server was attacked on June 6; member email addresses and encrypted passwords, up to 101,988 records, may have leaked.

Disclosed

2022-06-24

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The site server was accessed from outside through SQL injection. [1]

  2. A business partner asked about a possible leak of personal data, and it began an investigation with an outside security firm. [1]

  3. It confirmed the unauthorized access and announced it. It closed the site and related sites, cut them off from external networks and reset login passwords. [1] [2]

Impact

Email addresses and encrypted login passwords of members of its research report sales and viewing service (YRI WEB members and YDB members), up to 101,988 records, may have leaked. It holds no card data, and confidential data from its research and commissioned work is in a separate system and did not leak. No secondary damage was confirmed. [1]

Timeline

  1. Started 2022-06-06
  2. Detected 2022-06-13
  3. Disclosed 2022-06-24
  4. 18 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスによる個人情報漏えいに関するお詫びとお知らせYano Research Institute Ltd. · 2022-06-24
  2. [2][News]最大で10万以上の情報が漏えいか　矢野経済研究所が不正アクセス被害を報告 - ITmedia エンタープライズITmedia Enterprise · 2022-06-29