Ateam: Google Drive sharing mistakes left the personal data of 935,779 people viewable

1. 2023-11-21

   A report checking the accuracy of a security product under consideration flagged risky files, and it found that some files on the group's Google Drive could be viewed by outsiders. [1]

2. 2023-11-22

   It restricted access to the files and ended the viewable state. [1]

3. 2023-12-07

   After a preliminary report to the Personal Information Protection Commission, it published a first notice. [1]

4. 2023-12-20

   It filed the final report with the Personal Information Protection Commission. [1]

5. 2023-12-21

   It published the investigation results. [1] [2]

Files containing personal data numbered 1,369 and the people affected 935,779 (unique). They include past customers of its services, contacts at business partners, job applicants and interns, and employees including former ones. The data included device identification numbers, customer management numbers, email addresses and names, but no special-care data or data that could cause financial loss. No misuse has been confirmed. [1]

The cause was leaving the viewing range of files made on Google Drive at "anyone on the internet with the link". The viewable period runs from the creation of the oldest file, March 2017, to November 22, 2023. [1]