HANOWA: cloud storage of the Hanowa dental staffing service was open to anyone for over six years, with ID images and data of up to 49,309 people

1. 2026-10-14

   An internal check found it around 11 a.m. The setting was fixed between about 5 p.m. and the next morning. [1]

2. 2026-10-16

   Around 1 p.m. the exposed document images were deleted. [1]

3. 2026-10-19

   Reported to the Personal Information Protection Commission and disclosed. [1]

Up to 49,309 people after removing duplicates. No access logs were kept, so whether anyone looked cannot be checked, and it is treated as a possible leak. [1]

• Names, nicknames, email addresses and clinic names: up to 47,683 people [1]
• ID and licence images and bank account document images submitted between June 2019 and December 2025: up to 10,311 people [1]
• Messages and attachments in the old chat function, which ran until October 2024: up to 15,482 people [1]

Passwords and card data are not included. [1]

From June 2019 the cloud storage could be read by other logged-in users, and from 18 June 2020 by anyone at all, until 16 October 2026. The data did not show on normal screens and took technical know-how to reach. [1]

Besides the setting that let anyone read the storage, there was no procedure to check it, and old data no longer in use was kept. Some document images were saved with no restriction from the start. [1]

Affected people are being emailed. All permission settings of outside services will be checked, access logs kept and rules set for deleting data no longer needed. [1]