It was announced that 67 inquiry records from Medinet’s e-ha promotional landing page, covering the period from 2018 to 2021, had been leaked after deficiencies in authentication and API access-rights management at the external service CVX were exploited.
Among the inquiry information received through the promotional page for the “e-ha series” of services for dental clinics, data submitted between 2018 and 2021 has been affected by the data breach. The leaked data includes dental clinic names, individuals’ names, clinic telephone numbers, email addresses and messages. The number of affected records is reported to be 67, and it has been pointed out that the data includes information that could identify individuals.
ポストスケイプ, the provider of CVX, has cited deficiencies in authentication and API access control as the cause of the unauthorised access. The company has reported that corrective measures have already been completed, and that this disclosure is intended to explain the impact on information collected through past promotional pages. It has also been stated that this is not an announcement that all e-ha series services or medical information have been compromised.
The company plans to proceed with reporting to the Personal Information Protection Commission through the CVX administrative office, and is calling on dental clinics that may be affected to check their past inquiry histories and remain alert to suspicious communications. It has also been pointed out that the company should review its management of historical data and external contractors, suspend access privileges appropriately, and coordinate the deletion of data.