> JapanHacked_
[Resolved][Severity: Critical][Credential abuse]

KREO: unauthorized logins to the survey site Naruhodo MC.net, with points exchanged fraudulently

From February to the end of March, logins with IDs and passwords obtained elsewhere may have exposed up to 22 profile fields, and points were exchanged fraudulently in five cases.

Disclosed

2020-05-26

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

From February to the end of March, a third party logged in as members. The company said the IDs and passwords used had been obtained elsewhere. [2]

  1. Public disclosure. The site was suspended, to reopen in June after security work. [1] [2]

Impact

Some accounts show that profile pages were opened, so up to 22 fields of personal data, including names, addresses, birth dates and email addresses, may have been taken. Points were fraudulently exchanged in 5 cases. [2]

Timeline

  1. Disclosed 2020-05-26
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak][Fraud]
Entry point
Stolen credentials

Data exposed or at risk

[Name][Postal address][Date of birth][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]アンケートサイト「なるほど MC.net」にパスワードリスト型攻撃、ポイント不正交換確認（クレオ）ScanNetSecurity · 2020-06-03 08:00
  2. [2][News]アンケートサイトで不正ログイン - ポイントの不正交換もSecurity NEXT · 2020-06-02