National Cybersecurity Center: a flaw in a mail system device was exploited and mail data containing personal information may have leaked

1. 2023-06-13

   It found traces of unauthorized communication in its email-related system. [1] [2]

2. 2023-06-14

   It stopped operating the system to check its state. Through June 15 it replaced the device suspected as the cause, confirmed that other devices were normal, strengthened internal monitoring and restarted the system. [1] [2]

3. 2023-06-21

   An investigation by the maintenance contractor found evidence that the unauthorized communication was caused by a flaw in the device. It reported to the Personal Information Protection Commission. [1] [2]

4. 2023-08-04

   It announced the case. The cause is thought to be a flaw in the device that the maker had not identified, and similar cases have been seen abroad. [1] [2]

5. 2023-08-07

   JPCERT Coordination Center announced the effect on those who had asked it for incident response. [3]

Part of the mail data containing personal information, sent and received over the internet from early October 2022 to mid-June 2023, may have leaked. It includes personal information such as email addresses. The count has not been published. [1] [2]