[Resolved][Severity: Major][Credential abuse]

giftee: password list attacks broke into 411 giftee accounts, and 32 users were charged for purchases they did not make

In August and again in September, attackers logged in with IDs and passwords likely leaked elsewhere, changed account details and made purchases on some accounts.

Disclosed

2020-08-28

Organizations involved

Leaked or at risk

411

Downtime

Unknown

What happened

2020-08-19
From this day to August 24, login attempts using password lists went on. [1] [2]
2020-08-24
Several users asked about change notices they had not triggered, and checks found the attack. The 337 entered accounts were disabled and the Tokyo police were informed. [1] [2]
2020-08-28
Public disclosure. [1] [2]
2020-09-12
With monitoring stepped up, another attack was detected. 74 more accounts were entered and 3 users were charged. Logging in by email address now requires a password reset each time. [1]

Impact

337 accounts were entered in August and 74 in September. Nicknames, email addresses, genders, birth dates, purchase histories and, for users with saved cards, the last 4 digits and expiry may have been seen. 29 users in August and 3 in September had their details changed and were charged. [1] [2]

The fraudulent charges were being cancelled with the payment processor. Full card numbers and security codes are not stored in giftee's systems, so they did not leak. [1]