UUUM: an administrator authentication key for GitHub was readable on a web server, leaving all source code and personal data obtainable

1. 2022-06-19

   From this day, the authentication key that could fetch the source code of the whole group was readable on the web server. [1]

2. 2022-10-21

   It confirmed that the key was readable and disabled it that day. It then also changed the access keys of the databases. [1]

3. 2022-10-25

   It reported to the Personal Information Protection Commission. [1]

4. 2022-11-10

   It announced the case. [1] [2]

With the key anyone could fetch all of the group's source code on GitHub, including private repositories, and the access keys in the code allowed viewing the personal data in the databases. The GitHub logs show access to the source code of external systems (CREAS, UUUM iD) and internal systems. No history of database access was found and no misuse of personal data. The cause was uploading a key with strong privileges to a production server. [1]