Exceed Connect: Koriyama City KidZania event winners list emailed to the wrong address; 516 records at risk
On 20 November 2024 Koriyama City announced that, for its Out of KidZania in Koriyama 2024 event, contractor Tohoku Hakuhodo and subcontractor Exceed Connect had mistyped the city's email address and sent the winners list to an outside address. The list went out on the night of 15 November, and on the morning of the 16th the password for the 14 December list was sent to the same wrong address. 516 records of participants' names, gender, school year, guardian names, addresses, phone numbers and email addresses may have leaked. The recipient never replied, and deletion could not be confirmed.
Disclosed
2024-11-20
Organizations involved
2
Leaked or at risk
516
516
Downtime
Unknown
Timeline
- Started 2024-11-15
- Detected 2024-11-16
- Disclosed 2024-11-20
- 5 days
Attack or cause
- Method
- [Misdelivery]
- Impact
- [Data leak]
- Entry point
Data exposed or at risk
Supply chain
Organizations involved
[Through a supplier][Moderate]Fukushima, KoriyamaMunicipality516 leaked
Koriyama City[Breached][Moderate]Miyagi, SendaiScientific research, professional and technical services
Exceed Connect Inc.
Sources
- [1][Official]「Out of KidZania in こおりやま 2024事業」における電子メールの誤送信についてKoriyama City · 2024-11-20
- [2][Official]「Out of KidZania in こおりやま 2024事業」における電子メールの誤送信及びサーバーへの不正アクセスについて(最終報告)Koriyama City · 2025-04-01