[Contained][Severity: Critical][Web app exploit]

Gakuyu Publishing: SQL injection on the Aichi Zenken mock exam site may have leaked about 282,000 examinee records

SQL injection hit the Aichi Zenken mock exam site, and about 282,000 examinee records such as name, gender, cram school code and student ID may have leaked. Names were encrypted.

Disclosed

2025-06-30

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2025-06-30
It said it had noticed unauthorized access to its server by SQL injection in late April and, after investigating with an outside security firm, announced that examinee data may have leaked. It also reported to the Personal Information Protection Commission. [1] [2] [3]

Impact

Records on examinees who applied through cram schools may have leaked: about 282,000 entries of name, gender, cram school code, student code and student ID, with names encrypted. Separately, about 16,000 entries of examinee name, address, phone number, gender, guardian name and email address, about 16,000 entries of school-choice data, and about 8,000 entries about cram schools such as name, address and contact person are also covered. These items were said to be encrypted as well. [1]

ScanNetSecurity reported about 320,000 records and Cybersecurity.com about 330,000. [2] [3]