SHINDO5

Aichi Zenken Moshi

Gakuyu Shuppan Co., Ltd.

Mock exam takers~282,000records

POSSIBLE LEAKUsage history / GenderUnauthorized access · Closed (final report)

Open in the live monitor ▶
Disclosed
Jul 8, 2025
Detected
Apr 2025
Detection to disclosure
98 days
Leak
Leak possible
Type
Unauthorized access
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName (encrypted), Gender
Account dataStudent code, ID and cram school code
ContactAddress, Phone number, Email address
Family & private lifeGuardian name
Transactions & activityAcademic results
Business dataCram school names, addresses, contact details and staff names

How many

  • Mock exam takers ~282,000 records
  • Names, addresses, guardian names and more ~16,000 records
  • Student codes, academic results and more ~16,000 records
  • Cram school facility records ~8,000 records

Who is affected

  • Mock exam takers
  • Guardians
  • Cram schools

Cause

Unauthorized access to the web server by SQL injection

Timeline

  1. Attack detected in late April
  2. Reported to authority
  3. Date of the Security NEXT report

Response

  • Forensic investigation
  • Notified individuals

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. You can be affected without ever using this service (parcel recipients etc.). Check any notice you receive
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Patch internet-facing servers, VPNs and admin panels first. Exploits follow disclosure within days
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources