> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Shinzone: internal portal exposed by a cloud misconfiguration, making data of about 42,400 customers viewable

An internal portal was left public by a cloud misconfiguration, making personal data of up to about 42,400 customers and employees viewable from outside.

Disclosed

2024-05-22

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It found that its internal portal had been public. It made the portal private at once and changed the passwords of related systems. [1]

  2. It announced the case. [1] [2] [3]

  3. It reported the investigation results to the Personal Information Protection Commission. [1]

  4. It published the final report. An external specialist investigation found no leak of personal data, and the investigation ended. [1]

Impact

Customer and employee personal data managed on the portal could be accessed from outside. News reports put the customers at about 42,400. The portal was exposed from August 2, 2023 to May 15, 2024. [2] [3]

Timeline

  1. Started 2023-08-02
  2. Detected 2024-05-15
  3. Disclosed 2024-05-22
  4. 294 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]個人情報を含む情報漏洩のおそれに関するお詫びとお知らせShinzone Co., Ltd. · 2025-03-12
  2. [2][News]クラウド環境誤設定で顧客等情報4万2,400件公開状態│シンゾーンCybersecurity.jp · 2024-05-30
  3. [3][News]社内用ポータルサイトを誤って公開、最大 約 42,400 名の顧客の個人情報がアクセス可能にScanNetSecurity · 2024-05-29 08:05