According to Security NEXT, Kanagawa Prefecture announced that Kizuki, a contractor for its support program for freelance workers with disabilities, sent a misaddressed email on December 3, 2025 [1]. When placing a course schedule file on a shared drive, the contractor configured unnecessary access permissions, causing the system to automatically send an email with four support recipients in the CC field [1]. Recipients could see one another's email addresses; after being notified, the contractor apologized and requested deletion of the email [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Dec 26, 2025 and we added it on Nov 10, 2026. It is not a new event.
MediumMonitoringBackfillMedia reported
Misconfiguration in Outsourced Kanagawa Prefecture Support Program Exposes Four Email Addresses via CC
1 min read
- Disclosed
- Dec 26, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government
What to do nowOur advice
Recipients could see one another's email addresses; after being notified, the contractor apologized and requested deletion of the email [1]
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
Technical details
Source-Verified Summary
Kanagawa Prefecture announced that Kizuki, a contractor for its support program for freelance workers with disabilities, sent a misaddressed email on December 3, 2025. [1]
When placing a course schedule file on a shared drive, the contractor configured unnecessary access permissions, causing the system to automatically send an email with four support recipients in the CC field. [1]
Recipients could see one another's email addresses; after being notified, the contractor apologized and requested deletion of the email. [1]
References
Media1
- [1]
“神奈川県は、障害者フリーランス支援事業において、支援対象者に関するメールアドレスが流出したことを明らかにした。共有ファイルの権限設定により生じたという。”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.