Hamamatsu University School of Medicine

What leaked

How many

• Students and graduates 249 people
• Patient (in lecture material) 1 people

Who is affected

• Students and graduates
• Patient

Cause

When the system was updated in June 2024 the developer misconfigured it; no deletion rule was set for temporarily saved data, so data in a temporary folder on the server was viewable from outside

Timeline

1. Jun 2024Exposure began
2. May 15, 2025A graduate reported that their name and student ID could be seen online
3. May 15, 2025Access settings changed
4. Jul 31, 2025Date of the Security NEXT report

Response

• Config review
• Notified individuals

What you should do

1. ID numbers can never be changed. Request your credit file from CIC, JICC and others and look for contracts or loans you didn't make
2. Register a self-declaration (honnin shinkoku) with the credit bureaus so lenders check applications in your name more carefully. The stronger loan self-restriction scheme also blocks your own borrowing and can't be withdrawn for 3 months. Neither stops bank accounts being opened
3. Check the company's notice to see if you're affected

Lessons for companies

1. Put security requirements, audit rights and reporting deadlines in vendor contracts
2. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
3. Never sit on a known defect. Test every change before production
4. Don't keep ID or bank data: delete after checks or use a KYC provider
5. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
6. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources

• Security NEXT News · Jul 31, 2025