National Institute of Infectious Diseases: an old server left in place was broken into and used to post to an outside forum

At about 00:39 on 2020-03-02, the old official server www0.nih.go.jp, in use until 2012, posted one message to an outside private forum through the institute's proxy server. A forum user reported it, which led to the check. [1]

The folder of an application left on the server showed signs of tampering, and the logs showed a program that should not exist running at the time of the post. [1]

The institute shut the server's functions down, deleted the application, and checked a year of file changes and the logs of its other servers. It said it would look into how the intruder got in and have an outside firm re-test its web applications. [1]