President of the National Institute of Technology, Kagawa College,

Dr. Nobuo Araki

June 14, 2024

Apology and Notice Concerning Possible Leak of Personal Information of Students at Our School Dormitory Due to Program Design and Configuration Errors

Dear Parents, Guardians, and Students

It has come to our attention that the " status viewing screens" set up in the service used by our school to manage dormitory students' meal intake and to check students' names, room numbers, and class names were accessible online without logging in as an administrator. After discovering this, we immediately stopped the service. We then received access logs from the service provider to confirm whether the site was being viewed online and investigate the cause. We would like to update you on the current status of this matter.

To date, there has been no confirmed evidence of misuse of our dormitory residents' personal information; however, we will set up a hotline to answer any questions or concerns our residents and their parents may have.

We deeply apologize for the inconvenience and concern caused to all those involved in this incident.

1. Overview and Cause of the Incident

On April 26, 2024, it was discovered that the SaaS service "Overnight Stays, Roll Calls, and Missed Meals System for Student Dormitories," which our school has implemented to manage the meal intake and other information of students in our dormitories, had flaws in its program design and settings that allowed third parties to view the dormitory occupancy status at the time of viewing via a specific URL. As the service introduced by our school has been viewable since September 2015, the information of students listed in section 2 below who lived in the dormitory from September 2015 to April 2024 may have been viewable online.

After this matter became known, we suspended the service's operation on April 26, 2024, and took measures to make it impossible to view online.

The cause of the problem was that the service provider (Atleaf Corporation. (512-10 Kozaiminamimachi, Takamatsu City, Kagawa Prefecture)) did not take any measures to prevent each status viewing screen from being made public on the Internet when designing and building the program. This made it possible for third parties to view dormitory occupancy status via a specific URL.

2. Personal information that may be leaked

Number of subjects: 1295 students：Student's name, grades, department, dormitory room number, dormitory status.

3. Responses to date and the presence or absence of secondary damage

The service was stopped, and the logs were checked. No cases of secondary damage have been confirmed so far, but if you become aware of any misuse by a third party, please contact the contact listed in Section 5 below.

4. What's Next?

We will resume the service's operation as soon as we confirm that the school and the National Institute of Technology Headquarters have adequate program design and that the service settings have been resolved.

5. For inquiries regarding this matter (contact)

Head of General Affairs Section of National Institute of Technology, Kagawa College

Tel：+81-87-869-3810

E-Mail：s_kacho[@]t.kagawa-nct.ac.jp

Note: Please replace [@] with @ when contacting us via e-mail