JFC: data exposed by the business plan application system
Search-setting defects allowed registered teachers and student representatives under the same school designation to see one another's information. The issue was detected and fixed on September 25. Exposure of six people was confirmed. November's update listed four at-risk groups of 1,590, 4,855, 37 and 130 people; the largest group was 4,855. No secondary harm was confirmed.
Disclosed
2025-10-03
Organizations involved
1
Leaked or at risk
4.9K
4,855
Downtime
Unknown
Timeline
- Detected 2025-09-25
- Disclosed 2025-10-03
- 8 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, ChiyodaFinance and insurance4,855 leaked
Japan Finance Corporation
Sources
- [1][Official]高校生ビジネスプラン・グランプリ応募者情報の漏えいに関するお詫びとお知らせJapan Finance Corporation · 2025-10-03
- [2][Official]高校生ビジネスプラン・グランプリ応募者情報の漏えいに関するお詫びとお知らせ(続報)Japan Finance Corporation · 2025-11-14