> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

Chubb Insurance Japan: a setting error in its agency system let agencies without permission view other insurers' contract data

The contract reference range between lead agencies and affiliated agencies was set wrongly. Three affiliated agencies could view contract data of six insurers.

Disclosed

2024-01-12

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It announced that some contracted agencies could access customer data they had no permission to view. The system error has been fixed, and it is checking whether data was actually viewed. AIG General Insurance announced the impact on its customers the same day. [1] [2] [3]

Impact

The cause was that the reference range used to share contracts handled jointly by lead and affiliated agencies was not set properly. Three affiliated agencies (in Shizuoka, Tokyo and Okayama) could view contract data of six insurers they had no agency contract with: Aioi Nissay Dowa, AIG, Sompo Japan, Tokio Marine & Nichido, Nisshin Fire and Mitsui Sumitomo. [1]

The data that could be viewed includes names, addresses, phone and fax numbers, email addresses, birth dates, sex, contract details, policy numbers and beneficiary names. No misuse of contract data has been confirmed. [1]

Timeline

  1. Started, Detected, Disclosed 2024-01-12
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Date of birth][Gender]

Organizations involved

Open in organization search

Sources

  1. [1][Official]保険代理店向けシステムの参照範囲設定誤りによる情報漏えいに関するお知らせChubb Insurance Japan · 2024-01-12
  2. [2][Official]Chubb 損害保険株式会社による保険代理店向けシステムの参照範囲設定誤りによる情報漏えいの可能性についてAIG General Insurance Co., Ltd. · 2024-01-12
  3. [3][News]保険代理店向けシステムの参照範囲設定誤り、閲覧できない顧客情報にアクセス可能にScanNetSecurity · 2024-01-19 08:05