Results of the Investigation into the Leakage of Personal Information Caused by Unauthorized Access and Measures to Prevent Recurrence (Final Report)
株式会社 ApplyNow (a subsidiary of KICHIRI HOLDINGS & Co.,Ltd.)
The recruitment management platforms Interview Cloud, ApplyNow and ApplyNow Sign, and the connected databases
1. The provider's published vulnerability information was not identified, delaying application of the revised version. 2. Restrictions were not placed on source connections. 3. Although a mechanism was in place to detect and notify the Company of unauthorized operations, it took time to identify the incident. 4. The system was configured to allow the analysis tool to access data containing personal information; no data retention period had been specified, and data relating to companies and organizations that had ended their use of the service had not been deleted.
Related procedures
Consultation with the competent police station; submission of preliminary and final reports to the Personal Information Protection Commission
Personal Information Protection Commission; competent police station (name not stated)
Company response
A forensic investigation by an external specialist organization (started on 18 September 2026 and completed on 23 October). No organization name, committee chair name or details of the establishment of a committee were provided.
[Implemented] Blocking the unauthorized access route; disabling fraudulently created accounts, API keys and administrator accounts used without authorization; updating the data analysis tool to the revised version addressing the vulnerability; updating database connection information; restricting access to the data analysis tool to connections from permitted IP addresses; forcing all users to reset their administrative screen passwords; regularly checking vulnerability information and applying fixes within specified deadlines. [Planned] Deleting data relating to companies and organizations that have ended their use of the service (in progress); introducing a mechanism to detect suspicious operations and automatically notify the person in charge; expanding the items subject to database encryption; switching the data accessed by the data analysis tool to dedicated data processed so that it does not contain personal information; establishing retention periods for personal information and specified personal information and creating a mechanism for automatic deletion after the retention period expires; conducting regular vulnerability assessments by an external organization (once a year)
ApplyNow will implement measures to prevent recurrence, and KICHIRI HOLDINGS & Co.,Ltd. will confirm their implementation status. Group companies will continue to be encouraged to strengthen security and rigorously manage data containing personal information.
This announcement constitutes the final report. However, if any facts requiring further disclosure are identified, they will be promptly announced.
| Item | Details |
|---|---|
| Event name | Results of the Investigation into the Leakage of Personal Information Caused by Unauthorized Access and Measures to Prevent Recurrence (Final Report) |
| Date of occurrence | 9 August 2026 (a third party gained access and obtained administrator privileges). Parts of the database were viewed on 23 and 26 August, and data was retrieved in bulk on 7 September. |
| Date recognized / date notice received | 7 September 2026 (the anomaly was detected when the tool was suspended) |
| Subject Entity | 株式会社 ApplyNow (a subsidiary of KICHIRI HOLDINGS & Co.,Ltd.) |
| Target Locations / Products | The recruitment management platforms Interview Cloud, ApplyNow and ApplyNow Sign, and the connected databases |
| Cause | 1. The provider's published vulnerability information was not identified, delaying application of the revised version. 2. Restrictions were not placed on source connections. 3. Although a mechanism was in place to detect and notify the Company of unauthorized operations, it took time to identify the incident. 4. The system was configured to allow the analysis tool to access data containing personal information; no data retention period had been specified, and data relating to companies and organizations that had ended their use of the service had not been deleted. |
| Type of litigation or proceeding | Consultation with the competent police station; submission of preliminary and final reports to the Personal Information Protection Commission |
| Court or authority | Personal Information Protection Commission; competent police station (name not stated) |
| Date of filing / date of action | 10 September 2026 (consultation with the competent police station); 11 September 2026 (submission of the preliminary report to the Personal Information Protection Commission); 4 November 2026 (submission of the final report) |
| Investigation structure | A forensic investigation by an external specialist organization (started on 18 September 2026 and completed on 23 October). No organization name, committee chair name or details of the establishment of a committee were provided. |
| Measures to prevent recurrence | [Implemented] Blocking the unauthorized access route; disabling fraudulently created accounts, API keys and administrator accounts used without authorization; updating the data analysis tool to the revised version addressing the vulnerability; updating database connection information; restricting access to the data analysis tool to connections from permitted IP addresses; forcing all users to reset their administrative screen passwords; regularly checking vulnerability information and applying fixes within specified deadlines. [Planned] Deleting data relating to companies and organizations that have ended their use of the service (in progress); introducing a mechanism to detect suspicious operations and automatically notify the person in charge; expanding the items subject to database encryption; switching the data accessed by the data analysis tool to dedicated data processed so that it does not contain personal information; establishing retention periods for personal information and specified personal information and creating a mechanism for automatic deletion after the retention period expires; conducting regular vulnerability assessments by an external organization (once a year) |
| Outlook | ApplyNow will implement measures to prevent recurrence, and KICHIRI HOLDINGS & Co.,Ltd. will confirm their implementation status. Group companies will continue to be encouraged to strengthen security and rigorously manage data containing personal information. |
| Planned follow-up disclosure | This announcement constitutes the final report. However, if any facts requiring further disclosure are identified, they will be promptly announced. |
Items this document does not state (12)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The Company was unaware of vulnerability information published by the provider, delaying application of the revised version; restrictions had not been placed on source connections; it took time to detect and identify the incident after the system detected and notified the Company of unauthorized operations; and the data analysis tool was configured to allow access to data containing personal information, with no retention period specified and no deletion of data relating to companies and organizations that had ended their use of the service.