> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

Brave group: responses to several VTuber audition forms left accessible

VTuber company Brave group announced on 25 June 2024 that answers to the Google Form for the "VSPO! JP audition", managed in the group's Google Drive, had been viewable by third parties who knew the form's edit URL. The edit URL was set so that anyone on the internet with the link could view it. The same day, the same state was found for the "Brave group general audition" and the "HareVare VLiver audition". About 7,000 entries for VSPO! JP, about 2,610 for the general audition and about 1,043 for HareVare are affected, and may have been viewable from the evening of 4 June to 17:50 on 25 June 2024. The data includes names, prefectures (addresses where entered by mistake), phone numbers, birth dates, social media used and motivations. It came to light when a post on X drew attention, and access was restricted at 17:50 that day. On 2 July it added that 2,139 applicants to another audition were also affected.

Disclosed

2024-06-25

Organizations involved

1

Leaked or at risk

7K

7,000

Downtime

Unknown

Timeline

  1. Started 2024-06-04
  2. Detected, Disclosed 2024-06-25
  3. 21 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][Date of birth]

Organizations involved

Open in organization search

Sources

  1. [1][Official]個人情報流出に関するお詫びとご報告Brave group · 2024-06-25
  2. [2][News]オーディションの応募者情報が流出、SNSへの投稿も - Brave GroupSecurity NEXT
  3. [3][News]「ぶいすぽっ!」応募者の情報流出問題、「Googleフォームの予告ない仕様変更」が原因の一端かITmedia NEWS · 2024-08-01
  4. [4][News]再発防止策「Google Forms を使わない」ScanNetSecurity · 2024-08-07