> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

Mynavi: device management cloud misconfiguration

Incorrect permissions in the staff device-management cloud made 14,762 staff-related entries externally accessible from November 26, 2022 to September 2, 2025. The issue was detected and fixed on September 2. Names, staff identifiers, affiliations and email addresses were among the fields; no unauthorized-access evidence was found.

Disclosed

2025-10-03

Organizations involved

1

Leaked or at risk

14.8K

14,762

Downtime

Unknown

Timeline

  1. Started 2022-11-26
  2. Detected 2025-09-02
  3. Disclosed 2025-10-03
  4. 1042 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][E-mail address][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][Official]クラウド環境の誤設定に伴う個人情報の漏洩可能性についてMynavi Corporation · 2025-10-03