[Resolved][Severity: Moderate][Credential abuse]

Sumaizukuri Navi Center: a mail account of the Reform Hyoka Navi site was taken over and used to send spam

A mail account of the renovation review site, likely with an easy-to-guess password, was taken over early on July 30 and sent mass mail. Stored mail may have been read.

Disclosed

2020-07-31

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-07-30 00:00
At about this time, a third party got into one of the site's mail accounts and began sending a large volume of mail. [1] [2]
2020-07-30 05:26
The abuse was noticed and the account was stopped. [1]
2020-07-31
Public disclosure. [1]

Impact and response

Mail stored in the mailbox may have been read before the account was stopped, but no harm had been reported. The foundation said an easy-to-guess password was the likely cause and took steps to fix it. [2]