The Shimada exam ended in 2022, but its applicant file did not. The email you hand a hiring process should be one you can kill. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. Two Japanese cities confirmed on Thursday that a hiring vendor's breach leaked the personal data of 928 civil-service applicants. If you filmed a screening video for Fuji or Shimada City between 2022 and 2026, your name, phone number and email address are in someone else's file now. Both cities are warning you about calls from people pretending to be city hall.
ApplyNow spotted abnormal access logs on 7 September and shut the intrusion down that day. A month later, by 7 October, both cities emailed every affected applicant an apology and a warning, and the public announcement came the next day, reported by 静岡朝日テレビ.
The cities bought video screening. The attacker came through the analytics tool.
The disclosure was reported on 8 October by Daiichi-TV and 静岡朝日テレビ, drawing on both cities' announcements. The honest split:
| Confirmed | Still unconfirmed |
|---|---|
| The disclosure: both cities emailed affected applicants by 7 October and announced publicly on 8 October | Whether ApplyNow's wider investigation adds more client organisations to the victim list |
| Fuji City: 815 applicants across the 2022-2026 exam periods, all in the presentation-video screening test | Why the Fuji figure moved from "about 800" in September to 815; no source explains the revision |
| Shimada City: 113 applicants from the 2022 exam only (May-June 2022, general admin, university graduates) | Whether Fuji's leaked set also touched city-side accounts; no source reports it |
| Leaked fields: kana and kanji names, emails, phone numbers, exam numbers (Fuji); plus dates of birth and application receipt numbers (Shimada) | Whether the dataset has surfaced anywhere public (nothing reported so far) |
| Shimada's leak also includes city-side logins: usernames, passwords, email addresses and permission levels | Who is behind the access and what they want with hiring-exam data |
| Interview videos sat on a separate system and are not in scope, per both cities and the vendor | The final reconciliation of which records the attacker could actually see during the window |
| No confirmed misuse or secondary harm as of 8 October, per both cities |
The way in was never the product either city bought. ApplyNow, a Tokyo firm owned by the restaurant group きちりホールディングス, said on 9 September that an attacker had exploited a vulnerability in a data-analysis tool it used. The unauthorised access ran from 9 August to 7 September, per ApplyNow's own disclosure, summarised by piyolog and cybersecurity-jp.com. Two cities bought video-screening software. What the attacker walked through was an analytics tool bolted on beside it.
Shimada's file should have been deleted four years ago
Shimada City used ApplyNow exactly once: the 2022 exam, one hiring cycle, May and June. Four years later, the names, phones, emails and birth dates of those applicants were still sitting in the vendor's database when the attacker arrived.
The city spotted it. Its September notice says it would check with the vendor why data that should already have been deleted under the contract appeared in the leaked set, and the city's own page repeats the point. Read that plainly. For a 2022 applicant, the exposure window was not a few weeks in 2026. It was four years of a forgotten file waiting for someone to take it.
Fuji is the same failure in the other direction. Its 815 records span five exam periods, spring and autumn, 2022 to 2026, because the city used the video-screening system continuously from the 2022 general-admin exams onward, per the September reporting. Five cohorts. None of them could do anything about how long the vendor kept the data after the hiring decision was made. The applicant stops thinking about the exam when the results arrive. Nobody cancels the vendor's copy.
The one field in the file you can make expendable
The email address is the one field of this leak you get to choose. Everything else in the file, your name, your number, your birth date, is issued to you and fixed. The address you typed into the application form was a decision, and next time it can be a different one.
A dedicated email alias for each application, forwarding to your real inbox, changes the impersonation maths both cities are warning about. Picture what the attacker holds for each victim: a name, a phone number, an email address, and the knowledge that this person applied for a city job in a given year. A "city hall" message lands. On your everyday address it sits among your entire life and looks like everything else. On an alias used only for that one exam, the message identifies itself. Either it is the city or the vendor, the only two parties that ever had the address, or it is the attacker. There is no third option. A breach notice on that alias asking you to click a link and re-enter your details is the forgery talking: the real city already holds your details. Kill the alias and the whole impersonation channel dies while your real inbox stays untouched.
That is the leak-tracing mechanism pointed at exactly this attack. The set-up guide takes about two minutes. Aliases are persistent, managed addresses under your control: one per application, one per job portal. The next vendor breach names its source on arrival.
The forged city-hall call is the real attack
The cities are not warning about abstract risk. They are warning that someone will call, read your own details back to you, and sound like city hall following up on the breach.
今後、島田市や事業者等を装った不審なメール、電話等が届く可能性がある
"Going forward, you may receive suspicious emails or phone calls impersonating Shimada City or the vendor." (Shimada City official notice, 8 October)
Shimada's notice gives the operational advice: do not open links or attachments, do not enter personal or login information, delete the message immediately. The advice is this specific because the leak is this specific. A caller who "confirms your identity" by reading your exam number and date of birth back to you is proving nothing. Those fields leaked. They prove the caller has the file, not the job.
Shimada's version is worse than Fuji's in one respect, and it needs saying plainly: the leaked set includes the city's own staff logins for the system, usernames, passwords, email addresses, permission levels. The attacker holds the applicant data and the login details of the people on the other side of the desk. Impersonation material in both directions. The city's advice to delete rather than engage reads differently once you know that.
Anyone who "confirms your identity" by reading your exam number, date of birth or phone number back to you is showing they hold the leaked file, not that they work for city hall. Do not click, do not reply with details, and call the city on its published number yourself. Shimada's personnel division lists 0547-36-7135 for this incident.
If you sat one of those exams
- Expect the impersonation call or email, not the leak itself. Names, phones, emails and exam numbers are the raw material of a social-engineering attack, and the cities say this is the likeliest next step.
- Do not click links or open attachments in any message about this breach, even one that looks official. Reach the city through channels you find yourself. If you need to verify, call a number you looked up, not the one in the message.
- If the password you used for the exam matches one anywhere else, change it there now. Fuji's disclosed fields include no passwords, but Shimada's leak includes staff logins, and credential stuffing pairs leaked emails with passwords from other breaches on autopilot.
- Turn on two-factor authentication on your email. Leaked names, numbers and birth dates are the raw material of account-recovery flows, and 2FA is the part an impersonator cannot talk their way past.
- Check Have I Been Pwned once the incident is listed, and switch on its notifications so the next breach finds you first.
- Walk the breach-response order of operations: it is written for exactly this situation.
What to watch from here
Three things. First, whether either city's dataset surfaces publicly, which turns a contained vendor incident into a circulating one. Second, the numbers: Fuji moved from about 800 to 815 between September and October, and Shimada's 113 was already revised down from an early estimate of about 130. Watch whether either moves again. Third, the impersonation reports: none confirmed yet, so the cities' warning is still a forecast. If the calls start landing in the next few weeks, they will arrive on exactly the phone numbers in this file.
And there is the question Shimada put to its vendor in September, still unanswered in public: why was 2022 data, data that should have been deleted under the contract, still on the server in 2026. That answer matters beyond this incident. Every organisation still running ApplyNow is presumably sitting on the same retained history, and none of their applicants can see it.
The exam ended in 2022. The file did not.
Top comments (0)