> JapanHacked_
[Resolved][Severity: Critical][Misconfiguration]

i-plug: student names and emails in the response data of OfferBox pages for companies

On i-plug's OfferBox graduate job service, the response data of a page for client companies included names and emails of students who had not accepted an offer. They were not shown on screen, but could be seen with the browser's developer tools. A client company's question revealed it on 27 August, and the setting was fixed the next day. It had been the case since 12 May, affecting at most 314,009 students in theory. Release checks had covered only what the screen showed, not the data sent.

Disclosed

2026-10-05

Organizations involved

1

Leaked or at risk

314K

314,009

Downtime

Unknown

Timeline

  1. Started 2026-05-12
  2. Detected 2026-08-27
  3. Disclosed 2026-10-05
  4. Resolved 2026-08-28
  5. 146 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][E-mail address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]「OfferBox」システム設定不備に伴うお詫びとお知らせi-plug · 2026-10-05
  2. [2][News]新卒就活「OfferBox」、学生の氏名などを利用企業が開発者ツール経由で閲覧可能に 最大31万人ITmedia NEWS · 2026-10-06