[Resolved][Severity: Moderate][Credential abuse]

Kansai Electric: a password list attack on its Hapi e Miruden member site exposed the names and addresses of 5 users

Large-scale login attempts from changing foreign IP addresses began on August 5 against the power and gas usage site, and 5 accounts were broken into.

Disclosed

2020-08-06

Organizations involved

Leaked or at risk

Downtime

Unknown

What happened

2020-08-05 00:00
From about this time, attackers tried to log in as users with IDs and passwords obtained elsewhere, in repeated large waves from changing foreign IP addresses. The same day, 5 accounts were found to have been entered. [1]
2020-08-06
Public disclosure. [2]

Impact and response

Names, addresses and other details of the 5 users were seen. No points were exchanged and no plans were changed. The stolen passwords were blocked, and all members were to get a warning email. [1] [2]