> JapanHacked_
[Resolved][Severity: Moderate][Credential abuse]

Fujisawa City: the Oishii Fujisawa-san site run by a contractor was hijacked to send about 13,000 spam messages

The mail function of the city's local produce site, run by a nonprofit contractor, was used to send foreign-language spam. The contractor and city were at cross purposes.

Disclosed

2020-08-27

Organizations involved

2

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Large numbers of messages sent from the site's inquiry address bounced back as undeliverable, and the contractor closed the site. [1] [2]

  2. The contractor told the city's agriculture and fisheries section it had closed the site over a possible intrusion, then reported that it had restored the site from backup and reopened it. [1] [2]

  3. The city told the contractor to keep the site closed until the cause was known. [2]

  4. Mail was found to still be going out on and off. The server management firm changed the mail password, and the sending stopped. [1] [2]

  5. The contractor confirmed spam had been sent through an intrusion, and the city disclosed the case. [1] [2]

Impact

About 13,000 spam messages in foreign languages went out, 95% of them abroad. The site held no personal data, so nothing leaked, and the city's main website was not affected. [1] [2]

Timeline

  1. Started, Detected 2020-08-19
  2. Disclosed 2020-08-27
  3. 8 days

Attack or cause

Method
[Credential abuse]
Impact
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]藤沢市関連サイトに不正アクセス - スパム踏み台にSecurity NEXT · 2020-08-28
  2. [2][News]「おいしい藤沢産ホームページ」への不正アクセスで迷惑メールの踏み台に、委託先と市の対応に行き違い(藤沢市)ScanNetSecurity · 2020-08-31 08:00