> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Nikkei: a file with personal data of 3,763 webinar registrants was viewable on the internet for two weeks

On May 11 a system administrator wrongly set a private file to public. Data of 3,763 people was viewable until May 24. No outside access to the file was found.

Disclosed

2023-06-15

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. While the administrator of the streaming system was improving the system, the setting of a file that had been private was wrongly changed to public. [1] [2]

  2. It was found in an internet patrol by the people involved in the webinar, and it immediately blocked outside access to the file and deleted the file. [1] [2]

  3. It sent notices to the 3,763 people concerned and reported to the Personal Information Protection Commission. [1]

  4. It announced the case. [1] [2]

Impact

The data that was viewable was the names, email addresses, phone numbers, addresses, birth dates, annual incomes, financial asset amounts and more of the 3,763 people who applied for the asset succession and management webinar of August 19, 2022. For some applicants it also included bank account numbers. It was viewable for two weeks, from May 11 to 24, 2023. An investigation with a security firm confirmed that no outside third party accessed the file and that no information leaked. [1] [2]

Timeline

  1. Started 2023-05-11
  2. Detected 2023-05-24
  3. Disclosed 2023-06-15
  4. 35 days

Attack or cause

Method
[Misconfiguration]
Impact
Entry point
Unknown

Data exposed or at risk

[Name][E-mail address][Phone number][Postal address][Date of birth][Bank account]

Organizations involved

Open in organization search

Sources

  1. [1][Official]ウェビナー申込者の個人情報管理に関するお詫び : 最新情報 | 日本経済新聞社Nikkei Inc. · 2023-06-15
  2. [2][News]日経「資産承継・資産運用のウェビナー」参加申込者の個人情報が閲覧可能な状態にScanNetSecurity · 2023-06-22 08:05