> JapanHacked_
[Resolved][Severity: Major][Phishing]

Daiwabo Advance: an employee typed a mail password into a phishing site, and data of over 500 online customers may have been read

The mail account was accessed for about 2 hours 20 minutes, and mail with names, addresses and phone numbers of online customers may have been read.

Disclosed

2020-09-30

Organizations involved

1

Leaked or at risk

500

500

Downtime

Unknown

What happened

  1. An employee of the clothing maker entered the company mail password on a fake site linked from a phishing mail. The password was changed about 2 hours 20 minutes later, but in the meantime the account was accessed and mail may have been read. [1]

  2. The company disclosed the case and said it would notify and apologize to the customers concerned. [2]

Impact

Personal data of just over 500 customers who ordered online, or whom the company mailed about orders, between August 27 and September 11 may have been read. It includes names, addresses, phone numbers and mail addresses. [1]

Timeline

  1. Started, Detected 2020-09-11
  2. Disclosed 2020-09-30
  3. 19 days

Attack or cause

Method
[Phishing]
Impact
[Data leak]
Entry point
E-mail

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]フィッシング被害で顧客情報流出のおそれ - ダイワボウグループ会社Security NEXT · 2020-10-06
  2. [2][News]フィッシングサイトにパスワード入力、メール内容を閲覧された可能性(ダイワボウアドバンス)ScanNetSecurity · 2020-10-09 08:00