OfferBox exposed names and emails of 314,009 students to employers

Japanese student job service OfferBox, run by i-plug, showed employers the names and email addresses of up to 314,009 students from the 2027 and 2028 graduating classes between May 12 and August 28 due to a configuration error. The data appeared in the server payload rather than the interface, so the number of students actually viewed cannot be determined.

• Exposure lasted from May 12 to August 28, over three months
• Up to 314,009 students from the 2027 and 2028 classes affected
• Names were character-code encoded, email addresses were not
• Flaw found on August 27 after a client report and fixed the next day