ApplyNow: unauthorized access to its recruiting platform

ApplyNow, a Kichiri Holdings subsidiary, had its recruiting platforms Interview Cloud, ApplyNow and ApplyNow Sign accessed through a vulnerability in a data analysis tool it uses. The access ran from 9 August to 7 September, when abnormal logs were detected and the access was cut off. Applicant names (kana), emails and phone numbers and client staff user data were involved, and for ApplyNow Sign also contract data including employment contracts, My Number, basic pension numbers and bank account details. The 9 October update confirmed the leak and put it at about 390,000 people (about 30,000 of them ApplyNow Sign users), some with birth dates, gender, addresses and occupations; an outside investigation will fix the final count. Client Yoshinoya and Hanamaru said applicant data that should have been deleted after their contract ended was still there because no retention period had been set, and disclosed 5,366 applicant and 418 employee records.