> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Toyota Finance: unauthorized logins to its TS CUBIC CARD Mall member site

Logins with IDs and passwords stolen elsewhere broke into accounts on Toyota Finance's TS CUBIC CARD Mall site for card members.

Disclosed

2020-02-25

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

On the company's monitoring center detected unauthorized access to the card mall. Investigation showed that a third party had logged in as some members with IDs and passwords obtained illegally. [1]

Impact

The company confirmed the IDs and passwords had not leaked from it. It said it would contact members whose accounts may have been entered and arrange card replacement or password changes. [1]

Response

It blocked traffic from the sources of the attack one by one to keep it from spreading to other members. [1]

Timeline

  1. Detected 2020-02-11
  2. Disclosed 2020-02-25
  3. 14 days

Attack or cause

Method
[Credential abuse]
Impact
Entry point
Stolen credentials

Data exposed or at risk

–

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社カード会員向けＷＥＢサイトへの不正ログインについてToyota Finance · 2020-02-25
  2. [2][News]カード会員向けWebサイトへ不正ログイン、アクセス元の通信は遮断済（トヨタファイナンス）ScanNetSecurity · 2020-02-27 08:00