Ateam Google Drive misconfiguration exposed data on 935,779 people

Ateam Inc., a Nagoya-based Japanese internet company known for mobile games and comparison websites, disclosed in December 2023 that a Google Drive folder had been left viewable by anyone holding the link for more than six years.

The company said the sharing permissions were set incorrectly in March 2017 and were not caught until November 21, 2023, when a security product evaluation flagged the exposure. The settings were corrected the following day. Ateam put the number of people whose information may have been viewable at 935,779, spread across 1,369 files.

Those affected spanned several groups: customers of Ateam's apps and services, business partners, current and former employees, interns and job applicants. The exposed fields varied by file and included names, email addresses, postal addresses, telephone numbers, company names, and internal customer management and device identification numbers.

Ateam began emailing notifications to affected people on December 20, 2023, reported the incident to Japanese data protection authorities and published the findings of its internal investigation later that month. The company said no misuse of the exposed information had been confirmed. It said it would tighten cloud access controls, permission management and monitoring. ITmedia reported it was the second such disclosure by the company, following a similar data handling incident in 2022.