Japan Network Security Association (JNSA) Information Security Comprehension Test Service Breached; Up to 15,000 Records Potentially Exposed

What Happened

JNSA stated that on November 4 it confirmed unauthorized third-party access to its Information Security Comprehension Test Service, with investigation indicating that the attack may have begun on the evening of October 30 ^[1].

Scope of Impact

Up to approximately 15,128 records may have been exposed, covering administrator names, company names, email addresses, organization locations, employee counts, industry types, number of users, as well as user IDs and hashed passwords; the exact count and scope may change as the investigation progresses ^[1].

Response and Remediation

JNSA has suspended the service, engaged an external specialist firm to investigate the root cause and scope of impact, and plans to report the incident to Japan's Personal Information Protection Commission ^[2]. The association warned of potential emails impersonating JNSA and emphasized that it never asks users to enter or change their IDs or passwords via email ^[1].