Ochanomizu University: a lab server with a weak password sent about 3.09 million phishing emails

1. 2019-11-04

   A lab server opened to the internet in early November was logged into from abroad and began sending phishing emails, until 28 November. [1]

2. 2019-11-28

   After a tip from outside, the university cut the server off the network. [1]

3. 2020-01-28

   Public disclosure. [1]

{n:3086870} phishing emails went out from the university's IP address. None were found to pose as the university, and no secondary damage from leaked personal data was found. [1]

One registered user had an easily guessed password. [1]

The university changed the password and rebuilt the server from scratch. [1]