NIES: its file transfer service "Proself" was hit by a zero-day attack and data including personal data may have leaked

1. 2023-09-15

   From this day until the 22nd there was unauthorized access exploiting an unknown vulnerability (CVE-2023-45727) in the file transfer service "Proself". The developer did not know of it yet, and there was no patch or workaround. [1]

2. 2023-10-05

   The vendor reported that attacks on the vulnerability were happening. It investigated, confirmed traces of unauthorized access and stopped using the product the same day. [1]

3. 2023-10-10

   It found that the account list and password hash values were stolen and used to access some data on the server without authorization. [1]

4. 2023-10-30

   It announced the case. It has reported to the Personal Information Protection Commission and is contacting the people concerned. [1] [2]

Lists of staff who had health checkups, rosters of various committees and email addresses registered when using its data download service are known to have been stolen. It has the list of files that were downloaded and is checking the number of personal data records. No misuse has been confirmed. [1]