Skymark has announced that some personal information belonging to its employees and former employees had been accessible from outside the company.
The issue was discovered while the airline was inspecting its managed servers following the announcement on October 19 that access restrictions had not been properly configured for the administrative screen of an inquiry form for new graduate and graduate recruitment.
Employee photographs and employee ID numbers for 6,692 people, log data from employee systems for 4,247 people, and input records from employee systems for 5,467 people had been accessible. Former employees are included in all of these figures. The information did not include addresses, telephone numbers, or credit card information.
The cause was that internal files and records had been stored in a location without access restrictions. Although the location of the files (URLs) had not been provided either internally or externally, and there were no links to them from the website, they could be viewed by anyone who knew the URLs.
For the period for which access logs remain, there was no evidence that a third party had obtained personal information, and no secondary damage has been confirmed. As it cannot be confirmed that there was no access during periods for which no access logs remain, Skymark reported the matter to Japan’s Personal Information Protection Commission as a potential data leak.
The affected employees were notified individually. Those who left the company within the past five years and whose contact details are known were contacted by email. For those whose contact details are unknown, the company said that a notice on its website would serve as notification.
