Email Address Data Leak at Newsletter Contractor
Overview
A third party illegally accessed a service operated by Arara Inc., the contractor handling email delivery for an English-language newsletter commissioned by the International Strategy Division of the Ministry of Internal Affairs and Communications, and leaked subscribers’ email addresses and other information. The Ministry says it will contact affected people individually, require Arara to respond appropriately, and work to prevent a recurrence.
Key points
- The affected service was email delivery for an English-language newsletter.
- A total of 775 email addresses and 21 names were leaked.
- External access to the delivery service and the service itself have been suspended.
Overview
The International Strategy Division of the Ministry of Internal Affairs and Communications reported that Arara Inc., which had been contracted to handle email delivery for the English-language newsletter “ICT × Japan - Policy Information -,” had experienced unauthorized third-party access to its email delivery service and the external leakage of registered recipient information.
Impact
The Ministry apologized for causing concern to those involved and said it would contact people whose information was leaked individually by email.
Details
Those affected were subscribers to the Ministry’s English-language newsletter. The leaked information consisted of email addresses and the names of people who entered their names when registering. Credit card numbers, telephone numbers, and similar information were not included because they were not required for registration.
The incident was reportedly caused by a third party exploiting a vulnerability in an Arara web server, among other factors.
Arara has suspended external access and stopped providing the service. The Ministry says it has asked the company to respond appropriately and will work to prevent a recurrence by ensuring the strict and proper management and handling of personal information.