ApplyNow, a Tokyo-based provider of recruiting services, said on November 4 that a breach of its systems exposed the personal data of 396,920 people. The company had put the figure at roughly 390,000 when it first disclosed the incident on October 9, and has now finalized the count. Some of the leaked records include My Number — Japan's national identification number — as well as basic pension numbers and bank account details.
The data belongs to users of three services: Interview Cloud, which handles interview scheduling; ApplyNow, a recorded video screening service; and ApplyNow Sign, an electronic employment contract service. Those affected include job applicants, contract holders and corporate users. Of the total, 30,067 are people who signed employment contracts through ApplyNow Sign.
What was exposed
Across all three services, the names, email addresses, hashed passwords and permission settings of corporate users were leaked. Interview Cloud also exposed the names, phonetic readings, phone numbers and email addresses of people who applied for interviews. For some of them, the data includes selection details such as application and interview dates, plus dates of birth, gender and occupation.
ApplyNow Sign exposed the names, phonetic readings, phone numbers and email addresses of people who signed contracts through the service. For some, the leak also covers My Number, financial institution and account details, basic pension numbers, residence card numbers, employment insurance insured-person numbers, dependent deduction information, dates of birth, gender and addresses.
Credit card information, images of identity documents and interview videos were not part of the leak. As of November 4, ApplyNow said it had confirmed no secondary harm such as misuse of the leaked data.
A month inside the network
According to ApplyNow's investigation, the attacker exploited a vulnerability in a data analytics tool the company used internally and entered its systems on August 9. After gaining administrative privileges, the attacker viewed parts of its databases on August 23 and 26, then pulled information in bulk on September 7. The company detected the anomaly the same day after shutting down the tool, and disabled the fraudulent accounts and blocked the intrusion route.
ApplyNow attributed the breach to its failure to track vulnerability information published by the tool's provider, which delayed applying a fixed version. Because connections to the tool were not restricted by source, spotting the unauthorized activity also took time. The analytics tool was also configured so that personal data could be viewed through it, and the company had set no retention period for data, so information on companies and organizations remained stored after their contracts ended.
As countermeasures, ApplyNow has applied the patched version of the tool and limited access to it to specific IP addresses. It plans to delete data after contracts end, introduce automatic alerts for suspicious activity and set retention periods for personal information.