Sumitomo Realty: a misconfiguration in the cloud system of "Sumitomo Fudosan no Fureai+S" left 3,378 personal records viewable by third parties

1. 2023-01-19

   The service started. From this day, personal data in the cloud-based system outside the company was viewable by third parties. [1]

2. 2023-03-19

   Late at night it learned of the problem from a user's report. [1]

3. 2023-03-20

   It changed the security settings and deleted the pages that had been viewable. [1]

4. 2023-03-27

   It announced the case. [1] [2]

For 61 days from the start of the service on January 19 to March 20, 3,378 personal records (name, address, email address, phone number, birth date and others) were viewable by third parties because of an access-rights misconfiguration. No reports of misuse have been confirmed. It contacted the customers concerned individually. [1] [2]