> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Skymark: photos of 6,692 staff and former staff and internal system passwords were openly reachable

Internal files sat in places without access control, so photos, names, internal system passwords and other data on staff and former staff could be viewed from outside.

Disclosed

2026-11-02

Organizations involved

1

Leaked or at risk

6.7K

6,692

Downtime

Unknown

What happened

After the recruitment inquiry form issue it announced on 19 October, the airline checked its servers and found staff and former staff data that could be viewed from outside or inside the company. All of it was closed off, and the PPC was notified on 30 October. [1]

Impact

Data
People
Period
Photos and staff numbers
6,692
Until 21 October (start unknown)
Staff system logs (staff numbers, names, passwords, login history, donation and internal vote entries)
4,247
July 2008 to 21 October
Staff system input records (staff numbers, names, dates of birth, email addresses), reachable only from the internal network
5,467
21 May 2008 to 28 October
[1]

The counts include former staff and overlap. Addresses, phone numbers and card data are not included. Access records show no taking by outsiders and no misuse, but some periods have no records, so the airline treats it as a possible leak. [1]

Cause

Internal files and records were stored where no access control applied. Nothing linked to them, but anyone with the URL could open them. Passwords from the periods without records no longer work because changes are required regularly. [1]

Timeline

  1. Disclosed 2026-11-02
  2. 1 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Passwords][Date of birth][E-mail address][Employment]

Organizations involved

Sources

  1. [1][Official]当社社員の個人情報が閲覧できる状態にあったことに関するお詫びとお知らせSkymark · 2026-11-02