> JapanHacked_
[Resolved][Severity: Major][Misdelivery]

MHLW: data on designated intractable disease patients provided for research included forms with names and birth dates of 5,640 people

Data provided to researchers on June 27 included forms with personal data of 5,640 people. The files were recovered by August 9.

Disclosed

2022-08-15

Organizations involved

2

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It provided designated intractable disease patient data to third parties for research. [1] [2]

  2. A researcher reported that the provided data contained a sheet with the whole survey forms. [1] [2]

  3. All the provided files were recovered. There was no outflow beyond the researchers. [1] [2]

  4. It announced the case and suspended third-party provision. [1] [2]

Impact

The provided data held whole survey forms, with names, birth dates and addresses, of 5,517 people with IgA nephropathy and 123 with primary membranoproliferative glomerulonephritis, 5,640 in all. Five of seven facilities received data containing personal data, and six people viewed it. [1] [2]

The institute skipped the step of deleting the sheet in its extraction procedure, and the double check was insufficient. The ministry and its contractor also checked insufficiently. [1] [2]

Timeline

  1. Detected 2022-08-05
  2. Disclosed 2022-08-15
  3. 10 days

Attack or cause

Method
[Misdelivery]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Health data][Name][Date of birth][Postal address]

Supply chain

Organizations involved

Open in organization search

Sources

  1. [1][Official]指定難病患者データの研究利用のための第三者提供における個人情報の流出及びその対応についてMinistry of Health, Labour and Welfare · 2022-08-15
  2. [2][Official]指定難病患者データの研究利用のための第三者提供における個人情報の流出及びその対応について | 国立研究開発法人 医薬基盤・健康・栄養研究所NIBN · 2022-08-16