> JapanHacked_
[Contained][Severity: Major][Misconfiguration]

Benefit One: other companies' employee data in survey downloads

In the survey feature of Benefit One Platform, the employee benefits company's service for corporate HR staff, downloaded survey results included employees of other companies and organizations that the user should not have access to. A faulty program condition introduced in a June 2025 system change caused it; an internal check in October 2025 had found it but it was not fixed. A client's HR contact reported it on 30 July 2026. Staff numbers, names, genders, birth dates, departments, positions and joining and leaving details of 13,460 people at 2,322 organizations were affected. Only that one contact had downloaded the data, and it was deleted.

Disclosed

2026-09-30

Organizations involved

1

Leaked or at risk

13.5K

13,460

Downtime

Unknown

Timeline

  1. Detected 2026-07-30
  2. Disclosed 2026-09-30
  3. 62 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Gender][Date of birth][Employment]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社システムにおける個人情報漏えいに関するお知らせとお詫びBenefit One · 2026-09-30
  2. [2][News]アンケート結果をダウンロードしたら他社の従業員情報が…… ベネフィット・ワン、1万3460人分漏えいITmedia NEWS · 2026-09-30