Tokyo Kikaku: hijacked email account sent spam exposing 9,958 customer addresses

1. 2020-01-16 13:30

   One staff email account sent spam posing as an employee to many business contacts, until about 14:00. [1]

2. 2020-01-27

   The company published the results of its investigation. [3]

{n:9958} customer email addresses were listed as recipients and visible to everyone who got the mail. Its "Access to View File" link led to a phishing site for IDs and passwords. [1] [2]

The computers showed no sign of malware; the account was most likely found by password spraying. The access came from the United Arab Emirates and the United Kingdom. [3] [2]

On the evening of 16 January the company apologized to the customers and asked them to delete the mail without clicking the link. It planned multi-factor authentication for all staff and regular review of Office 365 audit logs. [3]