Nikkei: a file with personal data of 3,763 webinar registrants was viewable on the internet for two weeks
On May 11 a system administrator wrongly set a private file to public. Data of 3,763 people was viewable until May 24. No outside access to the file was found.
Disclosed
2023-06-15
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
While the administrator of the streaming system was improving the system, the setting of a file that had been private was wrongly changed to public. [1] [2]
It was found in an internet patrol by the people involved in the webinar, and it immediately blocked outside access to the file and deleted the file. [1] [2]
It sent notices to the 3,763 people concerned and reported to the Personal Information Protection Commission. [1]
Impact
The data that was viewable was the names, email addresses, phone numbers, addresses, birth dates, annual incomes, financial asset amounts and more of the 3,763 people who applied for the asset succession and management webinar of August 19, 2022. For some applicants it also included bank account numbers. It was viewable for two weeks, from May 11 to 24, 2023. An investigation with a security firm confirmed that no outside third party accessed the file and that no information leaked. [1] [2]
Timeline
- Started 2023-05-11
- Detected 2023-05-24
- Disclosed 2023-06-15
- 35 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, ChiyodaInformation and communications
Nikkei Inc.
Sources
- [1][Official]ウェビナー申込者の個人情報管理に関するお詫び : 最新情報 | 日本経済新聞社Nikkei Inc. · 2023-06-15
- [2][News]日経「資産承継・資産運用のウェビナー」参加申込者の個人情報が閲覧可能な状態にScanNetSecurity · 2023-06-22 08:05