[Resolved][Severity: Major][Credential abuse]

JR East: credential stuffing through the Ekinet app logged into 3,729 member accounts

Attackers used IDs and passwords probably leaked elsewhere to log into 3,729 accounts of the Ekinet train booking service through its app; 13 members' details may have been viewed.

Disclosed

2020-03-03

Organizations involved

Leaked or at risk

3.7K

3,729

Downtime

Unknown

What happened

From the evening of 2020-03-02 until after noon the next day, a specific IP address abroad tried a large number of logins through the Ekinet app. It looked like an attack with IDs and passwords leaked from other services; the company denied any leak from its own systems. [1] [2]

Impact

3,729 accounts were logged into. In 13 of them the member page was opened, so names, addresses, phone numbers, birth dates, email addresses, the last four digits and expiry of credit cards and linked transit IC card numbers may have been seen. [2] [3]

Response

The company force-reset the passwords of all accounts that were logged into and told the members by email; it phoned the 13 members whose details may have been seen. No such attack was found on the website version. [1] [2]