ApplyNow Breach Exposes Data of 396,920 People in Japan

All three services lost corporate users' names, email addresses, hashed passwords and permission data. Interview Cloud also leaked applicants' names, phonetic readings, phone numbers and email addresses, and in some cases application and interview dates, birth dates, gender and occupation. From ApplyNow Sign, names, phone numbers and email addresses leaked, and for some people also My Number, bank and account information, basic pension numbers, residence card numbers, employment insurance numbers, dependent deduction details and addresses.

Credit card data, images of identity documents and interview videos were not affected. As of November 4, the company has confirmed no secondary harm such as misuse of the leaked data.

How the attack happened

According to ApplyNow, the attacker exploited a vulnerability in a data analytics tool used internally and entered the system on August 9. After obtaining administrator rights, the attacker viewed parts of the database on August 23 and 26 and extracted data in bulk on September 7. The company noticed the anomaly that day when the tool stopped, then disabled rogue accounts and blocked the intrusion route.

The company named its failure to notice the vendor's published vulnerability information, and the resulting delay in applying the fix, as the cause. Because connections were not restricted by source, detecting the improper activity also took longer. Personal data was also reachable from the analytics tool, no retention period had been set, and data from clients whose contracts had ended was never deleted.

Next steps

ApplyNow has already applied the patch and limited access to the analytics tool to specific IP addresses. It plans to delete data after contracts end, introduce automatic alerts for suspicious operations and set retention periods for personal data.