[Resolved][Severity: Critical][Credential abuse]

Kitamura: credential stuffing on the Camera no Kitamura net shop got into about 400,000 accounts

Logins from abroad with credentials stolen elsewhere got into about 400,000 accounts, exposing names, addresses and order histories. Points paid for a few fake orders.

Disclosed

2020-06-15

Organizations involved

Leaked or at risk

400K

400,000

Downtime

Unknown

What happened

2020-04-04
Logins from several IP addresses outside Japan began, using email addresses and passwords apparently obtained elsewhere. [1]
2020-05-27
By this day about 400,000 accounts had been logged into. [2]
2020-05-28
The company looked into a rise in logins and found the problem. [1] [2]
2020-06-15
Public disclosure. Unauthorized access was still going on. [1] [2]

Impact

In about 400,000 accounts, names with readings, postal codes, addresses, birth dates, phone numbers, gender, email addresses, nicknames, up to four favorite stores, order histories and T-Point balances may have been seen. The shop holds no card data. A few fake orders were paid with points, and one was shipped. [1] [2]

Response

The passwords of affected customers were reset, and they were emailed and asked to set new ones. Monitoring of the attacking addresses was stepped up. [1]