> JapanHacked_
[Investigating][Severity: Major][Web app exploit]

ROIS (Institute of Statistical Mathematics): an SQL injection attack hit the server of its joint research database and 5,527 email addresses may have leaked

On April 3 an SQL injection attack on the server of its joint research database was found. 5,527 email addresses of research participants may have leaked.

Disclosed

2023-04-12

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The server logs recorded an attack on this day, and again on March 16 and 17. [1]

  2. It found that an SQL injection attack aimed at email addresses had taken place. It stopped the server and cut it off from external networks to investigate. [1]

  3. It announced the case and sent apologies individually to the email addresses concerned. [1] [2]

Impact

The email addresses of 5,527 research participants of joint-use and joint-research projects adopted in fiscal 2018 or earlier may have leaked. There was no sign of attacks aimed at names, affiliations or passwords. A server configuration flaw is a possible cause and is being investigated. [1] [2]

Timeline

  1. Started 2023-02-07
  2. Detected 2023-04-03
  3. Disclosed 2023-04-12
  4. 64 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]【情報インシデント】統計数理研究所サーバに対する不正アクセスについて | 統計数理研究所The Institute of Statistical Mathematics · 2023-04-12
  2. [2][News]統計数理研究所のサーバにSQLインジェクション攻撃、メールアドレス5,527件漏えい可能性ScanNetSecurity · 2023-04-27 08:05