Unauthorized access affects JNSA, potential data leak of 15,000 records

Coding code on multiple computer screens — Jakub Żerdzicki / Unsplash

On November 6, the Japan Network Security Association (JNSA) announced that its "Information Security Understanding Check Service" experienced unauthorized access, leading to a potential leak of up to 15,128 personal records. The service has been suspended while investigations into the cause and extent of the breach are ongoing.

The data that may have been compromised includes names of service administrators, company names, email addresses, organizational locations, employee counts, industry types, user counts, as well as user IDs and passwords. The passwords were reportedly subjected to "hashing," a process that converts original strings into different values.

This service allows representatives from companies and organizations to register employees as participants, enabling them to solve questions related to information security to assess and analyze their knowledge levels. Participants, other than administrators, are managed without using personal names, instead using participant IDs.

JNSA confirmed the unauthorized access on November 4. Investigations suggest that the breach may have begun around the night of October 30. The exact method of intrusion remains unclear, and JNSA is collaborating with external experts to conduct a thorough investigation. The number of affected records and the overall impact may change as the investigation proceeds.

JNSA plans to contact users identified as potentially affected as soon as possible. According to the announcement on November 6, the organization is set to report the incident to the Personal Information Protection Commission on the same day. Additionally, JNSA has warned that the leaked information could be misused to send emails impersonating the organization or related agencies, urging caution against opening links or attachments in suspicious emails and advising users to verify the sender's identity. JNSA stated that it will never request users to input or change their ID or password via email links.