Hirata Corporation: a flaw in an old VPN device restarted for telework let attackers steal logins of 24 staff, which were then posted online

1. 2020-04-22

   The current VPN device could not handle the telework load, so the old device used until the previous year was hastily restarted. It had an unpatched flaw. [1] [2]

2. 2020-06-25

   User IDs and passwords were extracted from the old device. [2]

3. 2020-08-05 22:14

   IDs and passwords of 24 staff and of the device's admin account were posted on Twitter with data of about 900 other companies, downloadable for two weeks. [2]

4. 2020-08-06 12:46

   The company's IT contractor reported the leak. [2]

5. 2020-08-06 13:00

   At about this time the old device was shut down and the admin password of the current device was changed. [2]

6. 2020-08-07

   The passwords of the 24 exposed employees were changed. [2]

7. 2020-08-17

   By this date the file was no longer online. [2]

8. 2020-08-25

   Public disclosure. [2]

Leaked accounts were used in 31 login attempts, all refused because they did not come from registered company PCs. Logs from the file and other servers showed no sign of a break-in. [2]

The current VPN device was already patched against the flaw. The company said it would keep its VPN devices up to date and consider two-factor authentication. [2]