Nichii Gakkan: backup file on the care services site downloadable without authentication

A backup file containing messages sent through the inquiry form of Nichii Gakkan's care services website had been left on the web server, and anyone who entered the URL with its exact file name could download it without authentication. The company learned of it on 11 September from the contractor that maintains the site, and deleted the file. It had been downloadable since 11 May 2020. Inquiries from November 2015 to May 2020 contained personal data of 583 people, 99 of them with health or disability details. The logs that were kept showed no third-party access, but older logs did not exist, so a leak could not be ruled out. The cause was poor file handling and deletion at the contractor.