Security Knowledge
← Incident database

kamogawa-form-exposure-2026 · Disclosed 2026-09-09

鴨川市: data exposure and authorization boundaries

Inadequate survey-permission checking allowed respondents to view earlier submissions. Names, addresses and telephone numbers for 218 respondents were exposed; the follow-up excluded email addresses.

Configuration / exposure

Outcome: Exposure / potential leak. Third-party theft unconfirmed.

Entry path and evidence

  • Reported fact

    Inadequate survey-permission checking allowed respondents to view earlier submissions.

    [s1]事案の概要 / 原因 / 続報（9月9日）
  • Reported fact

    Names, addresses and telephone numbers for 218 respondents were exposed; the follow-up excluded email addresses.

    [s1]事案の概要 / 原因 / 続報（9月9日）

Timeline

  1. Event date reported by the source. [s1]

  2. Disclosure date established by the reviewed notice. [s1]

Reported response

  • Reported fact

    The campaign was stopped and all respondents notified.

    [s1]事案の概要 / 原因 / 続報（9月9日）

Evidence relevant to prevention

Operational controls to inspect

Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The reviewed disclosures do not establish attacker use of AI.

The first disclosure date is unknown; September 9 is the earliest reviewed update. A correction excludes email addresses from the exposed fields.

Sources

  1. [s1] 鴨川市 · Primary source

    鴨川市：事故に関する公表資料 ↗

    Reviewed 2026-10-09