i-plug: student names and emails in the response data of OfferBox pages for companies
On i-plug's OfferBox graduate job service, the response data of a page for client companies included names and emails of students who had not accepted an offer. They were not shown on screen, but could be seen with the browser's developer tools. A client company's question revealed it on 27 August, and the setting was fixed the next day. It had been the case since 12 May, affecting at most 314,009 students in theory. Release checks had covered only what the screen showed, not the data sent.
Disclosed
2026-10-05
Organizations involved
1
Leaked or at risk
314K
314,009
Downtime
Unknown
Timeline
- Started 2026-05-12
- Detected 2026-08-27
- Disclosed 2026-10-05
- Resolved 2026-08-28
- 146 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Osaka, Osaka, KitaInformation and communications314,009 leaked
i-plug, Inc.
Sources
- [1][Official]「OfferBox」システム設定不備に伴うお詫びとお知らせi-plug · 2026-10-05
- [2][News]新卒就活「OfferBox」、学生の氏名などを利用企業が開発者ツール経由で閲覧可能に 最大31万人ITmedia NEWS · 2026-10-06