Helpline for Yakuza victims fears it leaked their personal info

A local Japanese government agency dedicated to preventing organized crime has apologized after experiencing an incident it fears may have led to a leak of personal information describing 2,500 people who reached out to it for consultation. The Kumamoto Prefecture Violence Prevention Movement Promotion Center offers …

[DS999]

So now the Yakuza can get revenge on many people

All for the price of hiring a hacker for a few thousand bucks.

Plus they get the side benefit that no one is ever going to trust that or any similar organizations to keep them safe from the Yakuza, so the number of people willing to speak out against them is probably gonna drop by 99%.

Great job Kumamoto Prefecture Violence Prevention Movement Promotion Center!

[cyberdemon]

Re: So now the Yakuza can get revenge on many people

Yeah, it's that second point that worries me.

From the sounds of it, the hackers had TeamViewer or similar access for a few seconds / minutes before they were noticed. There seems a reasonable chance that this wasn't long enough to install a more sophisticated RAT or indeed exfiltrate data from the local government network

If they didn't actually get the data, then announcing it publicly will have done a lot more harm than good

[O'Reg Inalsin]

Re: So now the Yakuza can get revenge on many people

They made the right choice IMO. If they didn't, their is also a high likelihood the hackers would publicize and perhaps demand ransom - in which hiding it would be much worse.

[cyberdemon]

Re: So now the Yakuza can get revenge on many people

there

in which case,

[Anonymous Coward]

That is brutally irresponsible

Although I'm wondering if it really was a hack - it strikes me that it is probably easier to get an insider to collaborate (by, for instance, the usual threat to limbs and relatives).

[Sceptic Tank]

C:\README.TXT

One would kind-of assume that this type of information would be sitting encrypted in a database that is encrypted on an encrypted disk on a heavily fortified computer with tamper-proof HSM that resets itself even if nothing is wrong, all of which is encased in a steel shell inside a vault with no electricity or network access, pumped vacuum to prevent air-gapped access, etc., etc. Bit of a let-down when a complete stranger simply dials in from somewhere and takes all this stuff.

A bit like the other day when the Dutch police were robbed of all their personal details.

[Kraft]

Re: C:\README.TXT

And with a cascading procedure of interacting with the data.

On a sidenote: I wonder if we should consider the idea of a databank, which would serve as a safe storage and exchange system for data, similar to how a bank safeguards money.

Unlike money, people often don't hesitate to trust their data to various companies, even though it's frequently mishandled.

[Paul Herber]

Re: C:\README.TXT

So what is wrong with the locked filing cabinet in a disused toilet etc etc ...

[IanRS]

Re: C:\README.TXT

You just can't get the leopards these days.

[O'Reg Inalsin]

Re: C:\README.TXT

Leopards? Spots?

[An_Old_Dog]

Re: C:\README.TXT

I would not assume that this type of information would be sitting in an encrypted database [additional security measure descriptions omitted ...].

History -- even the pages of The Reg -- is/are overflowing with descriptions of confidential-data breaches and walkaways (zero effective protection) where the data stewards were governments, militaries, police, or businesses.

[TeeCee]

He cut off the internet...

And now he gets to cut off his own little finger.

[Kraft]

Harakiri

Or slightly harakiri himself...

[An_Old_Dog]

The Only Way to Keep Your Personal Data Safe

... is to never give it up.

Governments (not just the .JP government) have a data-collection fetish which needs to be harshly and repeatedly slapped down.

When it comes to computerised information, there is effectively no such thing as 'confidential'.

[FIA]

Re: The Only Way to Keep Your Personal Data Safe

....because no low paid employee has ever been bribed to open a filing cabinet??

[Wang Cores]

Re: The Only Way to Keep Your Personal Data Safe

Yeah, but everyone knows and accepts physical security practices. The authorities also have the ability to prosecute/punish bad actors when they break them.

[Phones Sheridan]

Re: The Only Way to Keep Your Personal Data Safe

....because no low paid employee has ever been bribed to open a filing cabinet??

Isn't that what the leopard is for?

[Doctor Syntax]

Re: The Only Way to Keep Your Personal Data Safe

In order to open a physical filing cabinet the employee has to actually go to it and risk being seen there.

[An_Old_Dog]

Re: The Only Way to Keep Your Personal Data Safe

@FIA: Whether the information is stored in computers or in phyiscal documents, I stand by my headline and first sentence.

Physical documents are less-bad because copying them takes substantially longer than copying computerised files. Running a photocopy machine, a document scanner, or standing over a desk with documents laid out on it, snapping away with a smartphone or a Minox camera increases the risk of discovery and arrest.

Further, with computerised files, one need not compromise a clerk or officer.

[Paul Herber]

Re: The Only Way to Keep Your Personal Data Safe

' is to never give it up'

or let them down ...