Nankai Electric Railway: the website of its shared office "Lieffice" was altered through unauthorized access; no customer data leaked

1. 2023-07-03

   At around 17:00 it learned of unauthorized access to the "Lieffice" website. [1] [2]

2. 2023-07-06

   It reported to the Personal Information Protection Commission and notified all My Page registrants by email. [1]

3. 2023-07-07

   It announced the case. The site is unavailable for maintenance. [1] [2]

4. 2023-09-20

   It published the investigation result. The official site and the customer information database are separate by system design, so unauthorized access to the site could not reach the database, and it judged that no information leaked. The causes were a simple admin ID and password on the site's content management system (CMS) and the use of a widely used CMS that is an easy target. It changed the CMS, made the password complex and had a third party run a vulnerability assessment. The site and all three shared offices reopened. [3] [4]

The HTML files of the official site were rewritten so that visitors were automatically forwarded to an unrelated site. The site was made private and did not reopen until September 20. The database holding My Page registration data (up to 3,720 people) was not reached, and nothing leaked. The site does not store credit card data. [3] [4]