Vantan: a server for its sites was accessed without authorization and it stopped the server and suspended the sites. Personal data may be affected

1. 2022-11-25

   Around 17:00 it found unauthorized access to a server used for its sites, stopped the server and suspended the sites. [1]

2. 2022-11-30

   It announced the case. Personal data may be affected, and it said no card data is involved. [1] [2]

3. 2023-01-13

   It published a second report. It found that the attacker got in through a vulnerability of a previously used version of the content management system. The Personal Information Protection Commission and the police have been notified. There is no trace of personal data being taken out, but it said a leak cannot be ruled out and began notifying the customers concerned in turn. [3] [4]

The server held personal data of 17,935 people who requested materials or booked events for its schools from August 1 to November 27, 2022: name, address, phone number, birth date, sex, email address, occupation, fields of interest and preferred event dates. Credit card data is not included. No misuse of the personal data has been confirmed. [3] [4]