SHINDO2

Toyama Prefectural University

Files made viewable253files

EXPOSEDHR / labour records / Profile fieldsMisconfiguration · Closed (final report)

Open in the live monitor ▶
Disclosed
Jan 5, 2026
Leak
Exposed, access unknown
Type
Misconfiguration
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

Account dataGrade records, Credit status of courses taken by students from other universities
Employment & HRPart-time lecturers' CVs

How many

  • Files made viewable 253 files
  • Grade records of Imizu Campus students 923 people
  • Part-time lecturers' CVs 6 people
  • Credit records of students from other universities 91 people
  • Students who accessed the files 23 people

Who is affected

  • Students
  • Part-time lecturers

Cause

Files meant only for a specific staff team were set so that all students and staff with university accounts could view them

Timeline

  1. From July 2022 at the longest
  2. Exposure ended
  3. Reported to authority
  4. Reported to the Ministry of Education (MEXT)
  5. First disclosure

Response

  • Config review
  • Notified individuals

Corrected the setting, interviewed students who accessed the files, and emailed affected people with an apology

What you should do

  1. Expect targeted phishing posing as HR or interview contacts
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources