> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Mynavi: personal data of 1,210 TECH+ seminar registrants was viewable by third parties through search engines for about three years

A sharing mistake on sales materials left names, email addresses and workplace details of 1,210 seminar registrants viewable through search engines.

Disclosed

2023-04-26

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It began providing the proposal materials concerned to client companies and sales agencies (the period differs by material). [1] [2]

  2. The materials became viewable through search engines. [1] [2] [3]

  3. The problem was found and the same day it made the materials on the CRM system private. [1] [2] [3]

  4. It announced the case. It apologized individually to the people concerned. [1] [2] [3]

Impact

The people concerned are 1,210 registrants of the Mynavi News Forum 2019 Autumn (November 2019) and the TECH+ Forum Cloud Infrastructure Day 2022 Dec. (December 2022). The data includes name, kana, email address, occupation, industry, job type, workplace name, address, phone, department and position, annual sales, employee count, fiscal period and role in operations. 30 proposal documents for seminar sponsorship were involved. The cause was that unneeded personal data remained in the source data of a chart in the materials, and the CRM sharing setting was mistakenly public. [1] [2] [3]

Timeline

  1. Started 2020-08-01
  2. Detected 2023-04-20
  3. Disclosed 2023-04-26
  4. 998 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][E-mail address][Phone number][Postal address][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][Official]お知らせ|TECH+(テックプラス)Mynavi Corporation · 2023-04-26
  2. [2][News]マイナビ「TECH+」で個人情報漏えいの可能性 セミナー参加者1210人分 - ITmedia NEWSITmedia NEWS · 2023-05-02
  3. [3][News]「TECH+」開催セミナー参加登録者1,210名の個人情報漏えい、検索エンジン経由で約990日間 第三者が閲覧可能にScanNetSecurity · 2023-05-01 08:05