[Contained][Severity: Major][Web app exploit]

JSPS: unauthorized access to its file transfer service "Proself" leaked personal data of 1,272 researchers, event participants and staff

From August 29 to September 20 an unknown vulnerability was exploited and some stored files were taken. Names, affiliations and other data of 1,272 people leaked.

Disclosed

2023-11-17

Organizations involved

Leaked or at risk

1.3K

1,272

Downtime

Unknown

What happened

2023-08-29
From this day until September 20 there was unauthorized access to the file transfer service "Proself", and some stored files were taken. [1]
2023-10-05
The provider told it that Proself had a vulnerability. It asked the service developer to investigate. [1]
2023-10-26
After the investigation report of October 25, it confirmed that the files taken contained personal data. [1]
2023-11-17
It announced the case. It has reported to the Personal Information Protection Commission and consulted the police. [1] [2] [3]

Impact

The personal data confirmed leaked covers 1,272 people in total: 391 people connected with overseas researcher exchange programs (name, affiliation, title, career summary, contact details, activity plan, reason for recommendation and so on), 569 participants of events and meetings in Japan and abroad (name, affiliation, title, career summary) and 312 JSPS officers and staff (name, email address and so on). No secondary damage has been confirmed. The cause was the retrieval of files on the server through an unknown XXE vulnerability. [1] [2]