> JapanHacked_
[Resolved][Severity: Critical][Credential abuse]

CyberAgent: a misused cloud access key left data of 1,027 Ameba ad users open to the internet for a time

Someone misused a cloud access key of the system behind CyberAgent's Ameba ad services and briefly opened user data, including password hashes, to the internet.

Disclosed

2020-04-07

Organizations involved

1

Leaked or at risk

1K

1,027

Downtime

Unknown

What happened

A third party used the access key and secret of a system the company runs on a cloud service (AWS). Data stored behind the Ameba ad management screen could be reached from the internet from late on into the early hours of the next day, and for about ten minutes on the evening of . [1] [2]

Impact

User names, password hashes, names, email addresses and ad delivery data of 1,027 users of the ad services Ameba Infeed and Ameba DSP were affected. [1] [2]

Response

The misused access key was revoked and the access settings the intruder had added were reverted. [1] [2]

Timeline

  1. Started 2020-04-04
  2. Disclosed 2020-04-07
  3. 3 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][E-mail address][Passwords]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]Ameba広告システムに不正アクセス - 内部データが公開状態にSecurity NEXT · 2020-04-07
  2. [2][News]AWSで運用する広告配信管理システムへ不正アクセス、1,027ユーザーの情報が一時アクセス可能に（サイバーエージェント）ScanNetSecurity · 2020-04-08 08:00