Rafool, the company behind the workplace improvement tool Rafool Survey, said on November 9 that unauthorized access to its old system exposed personal data on 24,232 employees at 182 client companies, including stress-check results.
The company traced the breach to an access key one of its engineers had written directly into a program. In 2019, a developer at a subcontractor published a test environment image containing that program on the internet.
Rafool estimates that a third party obtained the access key this way. The data continued to be taken from the old system even after the company moved to a new system on July 30.
Names, departments and stress-check results taken
Rafool Survey lets employees answer questions, and companies then analyze workplace relationships, turnover risk and staff mental and physical health.
The data taken includes employee numbers, names, departments and survey answers and results. For some people it also includes stress-check results and answers, and records of doctor interviews and guidance, which count as sensitive personal information under Japanese law.
Rafool said it has not confirmed any leak of addresses, phone numbers or passwords.
Contractor published the test image
The engineer at Rafool had written the access key into the program itself. The test environment image containing it was published online in 2019 by a developer at the company's then subcontractor, Flangia, now Sun Asterisk.
Rafool said its own oversight as the client was also inadequate. The current system runs on a separate cloud management unit and cannot be reached with the access key used in the breach.
Access found three months after the migration
On October 27, a Rafool engineer checking logs found signs of unauthorized access to the old system. The company disabled the misused access key the same day.
On October 28 it blocked communications from the overseas IP address used in the attack. On October 29 it found that the attacker had taken files from the old system's storage area between July 24 and October 25.
Files containing personal information were among those taken on July 24 and August 8.
Hard-coding dropped in the new system
The current system no longer writes access keys directly into programs. It uses temporary credentials that expire automatically after a short time.
On November 4, Rafool checked the current system's settings and access records and found no access or operations by the attacker. The company will commission an outside investigation and use its findings to draw up measures to prevent a repeat.