Osaka/Kansai Expo: Risk of personal information leak due to unauthorized access to subcontractors

On August 20, the Japan World Expo 2025 Association (hereinafter referred to as the ``Expo Association'') announced that a subcontractor for event operations had been accessed illegally, and emails and attached files containing personal information of Expo 2025 Osaka and Kansai officials and event performers may have been leaked. At this time, it has not been confirmed that personal information of general visitors was included.

On May 13th, the subcontractor's Microsoft 365 account was accessed illegally after an employee of the subcontractor received a phishing email posing as being from an overseas company. The subcontractor blocked access on the same day. The company says that it is possible that only the data contained in emails related to work commissioned by the Expo Association and their attachments were subject to unauthorized access, and that unauthorized access to other data has not been confirmed.

The Expo Association outsourced to contractors the management and management of event facilities, as well as operations related to events held at the Expo by participating countries and international organizations, which in turn subcontracted some of these tasks.

There is a risk of leaking the personal information of related parties, including employees of contractors and subcontractors, as well as event performers. This information includes the names, affiliations, titles, and email addresses of senders and recipients of emails sent and received by subcontractors, telephone numbers included in signatures, names, work shifts, and duties of employees of subcontractors, and information on the person in charge listed on estimates and invoices.

For event performers, in addition to their names, titles, and photos, information such as their speech manuscripts, proceedings scripts, and the flow of their arrival and departure from the stage will also be included. Credit card information has not been verified.

As of the 20th, no secondary damage such as unauthorized use of personal information due to this unauthorized access has been confirmed. However, as there is a possibility that a phone call or email may be sent pretending to be from the Expo Association or a related party, the government urged people not to open links or attachments in any unknown communications, and to carefully check the sender.

The Expo Association is confirming the status of safety management measures and incident reporting systems at subcontractors, management of subcontractors, and disposal and erasure of personal information that no longer needs to be held, and is once again calling for thorough information management.