The Japan Network Security Association (JNSA), which runs programs to spread awareness of information security, said on November 6 that its information-security comprehension check service was accessed without authorization by a third party and that up to 15,128 pieces of personal information may have leaked. User IDs and hashed passwords are among the data possibly exposed. The service is currently suspended.
The service lets companies and organizations check how well their employees understand information security. The data possibly leaked includes user IDs and hashed passwords, along with the name of the person at each client who manages enrollment, the company name, email address, organizational location, number of employees, industry and number of users.
Breach confirmed on November 4
JNSA confirmed the unauthorized access on November 4. Its investigation found the service may have been under attack from around the night of October 30. After detecting the breach, the association shut the service down to limit the damage and is investigating the cause and scope with an outside specialist firm.
The entry route is not yet known, and the number of leaked records may change, JNSA said. It plans to contact affected users individually once they are identified, and intends to report the matter to the Personal Information Protection Commission during November 6.
JNSA also warned that leaked information could be used for spoofing emails, and urged users not to open links or attachments in suspicious messages.