> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

Asahi Shimbun: names and addresses of 884 members of Asahi Shimbun Digital and the paper viewer leaked, found through an outside tip

It learned of the leak early on September 6 through an outside tip. Names, addresses, phone numbers and plans of 884 members in parts of Mie Prefecture leaked.

Disclosed

2023-09-06

Organizations involved

1

Leaked or at risk

884

884

Downtime

Unknown

What happened

  1. In the early hours it was told by an outside person that Asahi Shimbun customer data was leaking, and confirmed the situation. It announced the case the same day. It contacted the customers concerned and consulted and reported to the police and the Personal Information Protection Commission. It stopped part of the system concerned to prevent new leaks. [1] [2]

  2. It published the investigation results and reported to the Personal Information Protection Commission. The cause was that, when the system was updated in 2017, the mechanism to refuse outside access had not been built as designed. [3] [4]

Impact

The leaked data is the name, address, phone number and plan type of 884 members of Asahi Shimbun Digital and the paper viewer in parts of Yokkaichi, Suzuka, Kameyama and Kawagoe in Mie Prefecture, held in the system with which the company and Asahi Shimbun dealers manage customer data. Email addresses and credit card data are not included. The cause is under investigation. [1] [2]

A forensic investigation by an outside specialist confirmed only the 884 people and found no access to or leak of other information. A URL that led to member information had been registered in a search engine, and a temporary fault in viewing software on a terminal most likely sent the URL to the search engine. No secondary harm has been confirmed. [3]

Timeline

  1. Detected, Disclosed 2023-09-06
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][Official]個人情報の流出に関するお知らせとお詫びThe Asahi Shimbun Company · 2023-09-06
  2. [2][News]朝日新聞デジタルと紙面ビューアーの会員情報流出、社外からの指摘で発覚ScanNetSecurity · 2023-09-08 08:05
  3. [3][Official]個人情報流出(本年9月6日判明)に関する調査結果のお知らせThe Asahi Shimbun Company · 2023-12-19
  4. [4][News]朝日新聞デジタルと紙面ビューアーの会員情報流出、外部からのアクセス拒否が設計通り実装されずScanNetSecurity · 2023-12-29 08:05