> JapanHacked_
[Resolved][Severity: Moderate][Credential abuse]

Miyoshi Town Council of Social Welfare: a hijacked mail account sent large numbers of English scam emails

Someone logged into the council's mail account and sent large numbers of English scam emails asking for money.

Disclosed

2020-04-27

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From about this time, thousands of bounce notices arrived for mail the council had not sent. An investigation found scam emails sent from the hijacked account. [1]

  2. The password was changed, and changed again regularly afterwards, but scam emails may have gone out several more times. [1]

  3. The council warned on its website to delete suspicious mail and consulted the police. [1]

  4. It published the details. No data leak or payments by recipients had been found. [1]

Timeline

  1. Started, Detected 2020-04-24
  2. Disclosed 2020-04-27
  3. 3 days

Attack or cause

Method
[Credential abuse]
Impact
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]メールアカウントが詐欺メールの踏み台に、エラー通知メールで発覚(三芳町社会福祉協議会)ScanNetSecurity · 2020-05-11 08:00
  2. [2][News]不正アクセスでスパム踏み台に - 三芳町社会福祉協議会Security NEXT · 2020-05-08