> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

JTB: it misconfigured access rights on a cloud service for a Japan Tourism Agency subsidy project, and personal data of up to 11,483 people was seen by other businesses

Misconfigured access rights on a cloud service for a subsidy project let 18 other businesses download application documents with personal data of up to 11,483 people.

Disclosed

2022-10-25

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The misconfiguration came to light and JTB and the Japan Tourism Agency announced it. JTB asked the 18 businesses that had downloaded the data to delete it and received notice of deletion from all of them the same day. [1] [2]

Impact

The application documents of 1,698 applications for the project to create flagship products that earn in the regions using local tourism resources, and the subsidy application forms, were viewable among the businesses that could log in. The downloaded data contained personal data of up to 11,483 people (organization name, department, title, name, business phone number, email address and similar). There is no possibility of a leak to anyone other than the businesses with login rights. [1] [2]

Timeline

  1. Disclosed 2022-10-25
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][E-mail address][Phone number][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][Official]情報漏洩に関するお詫びとお知らせJTB Corp. · 2022-10-25
  2. [2][Official]株式会社JTBが管理・運用する情報共有ツールにおけるアクセス権限の誤設定による個人情報等の漏洩について | 2022年 | 報道発表 | 観光庁Japan Tourism Agency · 2022-10-25