Nara Prefecture said on the 6th that a domain it once used for a food promotion site, "Nara no Umaimono Plaza," expired and was reacquired by a third party. Connecting to the address now displays a screen closely resembling the old site, including images of the prefectural mascot Sento-kun. The prefecture is warning people not to access the old domain, citing concern it could be used for fraud or illegal sites.
The old domain is "narano-umaimonoplaza.com." According to the prefecture, when it overhauled its official website in March, sites that individual departments had opened separately were consolidated onto addresses using ".lg.jp", the domain reserved for local governments.
Contract lapsed after renewal deadline missed
Under a contract, a contractor was to hold and manage the old domain until March 2027 to prevent misuse and redirect traffic to the new address. The contractor forgot the renewal deadline, and the contract lapsed on June 9. A third party reacquired the old domain on August 27. The prefecture checked with the contractor and discovered the situation on September 17.
As of the 5th, no redirects to outside fraud sites or online casinos had been confirmed, but the screen design has been copied almost in full. The prefecture called it "an extremely malicious act that amounts to copyright infringement" and has applied to Google for a Safe Browsing warning that would block the screen from displaying. It plans to seek the return of the old domain, including by filing a complaint with a domain dispute resolution body.
The prefecture has removed links to the old domain from its website and social media. It is asking users to delete bookmarks to the old address and to check that a public site's address contains ".lg.jp" before using it.
The incident comes as several Japanese organizations report breaches of their own. A Tokyo metropolitan government email newsletter leaked information on about 16,000 users after unauthorized access to a contractor, in the continuing "Blast Mail" incidents. NewsPicks suffered unauthorized access that may have leaked user information, including credit card holder names, and unauthorized access to Yakult leaked about 40,000 pieces of personal data, including names and addresses, forcing the company to shut down its website.