Workstyle Tech: WelcomeHR server misconfiguration left ID images and other data of 162,830 people open

Workstyle Tech, a subsidiary of kaonavi, announced on 29 March 2024 that files stored by customers of its cloud HR service for part-time staff, "WelcomeHR", had been accessible from outside and that personal data had leaked. Because access rights on a storage server were set incorrectly, files could be downloaded using the file listing. A security check found the problem on 22 March and it was fixed the same day; on 28 March downloads by a third party were confirmed. Names, gender, addresses, phone numbers and images of ID documents uploaded by users (My Number cards, driving licences, passports and others) and CVs are affected: data of 162,830 people was accessible, and downloads of 154,650 were confirmed. The data was accessible from 5 January 2020 to 22 March 2024, and the downloads took place on 28 and 29 December 2023. Customer LeafNxT said on 22 April that 26,829 of its staffing registrants and applicants were included.