> JapanHacked_
[Investigating][Severity: Major][Intrusion]

MLIT Kinki Regional Development Bureau: unauthorized traffic at the Yodogawa Park reservation system "Yodoiko!", and registered users' data may have leaked

Unauthorized traffic hit a test server planned for rollout. Names, birth dates and bank accounts of registered users may have leaked, and the booking site was closed.

Disclosed

2024-03-07

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The Yodogawa Park Management Center reported unauthorized traffic from outside to a test server prepared for a system update. The test server was stopped promptly. [1]

  2. It announced the case. No unauthorized traffic was found on the live server, but it closed the booking site for safety and takes facility reservations by phone. It reported to Osaka Prefectural Police. [1] [2]

Impact

The data that may have leaked is registered users' names, birth dates, gender, addresses, phone numbers, email addresses, bank accounts, and login IDs and passwords. Email addresses and bank accounts were stored encrypted. The number of people was not stated. No leak to third parties or misuse has been confirmed. The site's reopening is undecided. [1]

Timeline

  1. Detected 2024-03-01
  2. Disclosed 2024-03-07
  3. 6 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

[Name][Date of birth][Gender][Postal address][Phone number][E-mail address][Bank account][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]淀川河川公園施設予約システム「よどいこ！」における情報流出の可能性についてKinki Regional Development Bureau, MLIT · 2024-03-07
  2. [2][News]淀川河川公園施設予約システム「よどいこ！」で不正通信、個人情報流出の可能性ScanNetSecurity · 2024-03-15 08:05