Shibushi City: unauthorized access to its hometown tax donation site may have leaked 910 card records and personal data of 2,280 donors

1. 2021-03-12

   The attacker placed on the site a malicious file that allowed the user information database to be operated from outside. [1] [2]

2. 2021-12-29

   It was confirmed that the attacker accessed the user information database through this file and viewed and downloaded the data. [1] [2]

3. 2023-06-22

   It published a first report covering 910 credit card records. [1] [2]

4. 2023-07-20

   It published a second report. The investigation of the other user data ended and found that personal data of 2,280 donors may have leaked. The people concerned were notified by email or post. [1] [2]

The data that may have leaked is the name, email address, phone number, address, date of birth and other data of 2,280 people (duplicates removed) who registered or donated from June 28 to July 5, 2019 and from March 11 to December 24, 2021. Of the 910 card records in the first report, 65 people suffered credit card fraud totaling 22,274 yen. No other misuse of personal data has been found. [1] [2]