Brave group: responses to several VTuber audition forms left accessible
VTuber company Brave group announced on 25 June 2024 that answers to the Google Form for the "VSPO! JP audition", managed in the group's Google Drive, had been viewable by third parties who knew the form's edit URL. The edit URL was set so that anyone on the internet with the link could view it. The same day, the same state was found for the "Brave group general audition" and the "HareVare VLiver audition". About 7,000 entries for VSPO! JP, about 2,610 for the general audition and about 1,043 for HareVare are affected, and may have been viewable from the evening of 4 June to 17:50 on 25 June 2024. The data includes names, prefectures (addresses where entered by mistake), phone numbers, birth dates, social media used and motivations. It came to light when a post on X drew attention, and access was restricted at 17:50 that day. On 2 July it added that 2,139 applicants to another audition were also affected.
Disclosed
2024-06-25
Organizations involved
1
Leaked or at risk
7K
7,000
Downtime
Unknown
Timeline
- Started 2024-06-04
- Detected, Disclosed 2024-06-25
- 21 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, MinatoInformation and communications7,000 leaked
Brave group Inc.
Sources
- [1][Official]個人情報流出に関するお詫びとご報告Brave group · 2024-06-25
- [2][News]オーディションの応募者情報が流出、SNSへの投稿も - Brave GroupSecurity NEXT
- [3][News]「ぶいすぽっ!」応募者の情報流出問題、「Googleフォームの予告ない仕様変更」が原因の一端かITmedia NEWS · 2024-08-01
- [4][News]再発防止策「Google Forms を使わない」ScanNetSecurity · 2024-08-07