Lean on Me: unauthorized access to Special Learning and others lets an attacker take data on 82,723 people

On 28 September Lean on Me, which runs the Special Learning e-learning service for disability welfare and the Special Shift scheduling tool, said an attacker exploited a vulnerability in the data analysis tool Metabase and took customer data. Its final report of 27 October says 82,723 people's personal data were taken, and that it filed the final report with the Personal Information Protection Commission on 26 October. Current customers are affected, along with past trial users and cancelled customers. The data include affiliated corporation and office, names, email addresses, hashed passwords, LINE IDs, and Salesforce records linked to Metabase (names, contacts, employer, deal and contract status, contract amounts, enquiry history). Some content in Special Learning's report function included sensitive personal information; the items and number of people were not given. No secondary harm has been found, and Salesforce itself was not breached.