JR Kyushu: a password list attack on its Web member site broke into 1,269 accounts and exchanged points

1. 2020-09-13

   From this day to September 15, logins from several foreign IP addresses used IDs and passwords that had likely leaked elsewhere. [1] [3]

2. 2020-09-16

   In the morning, a member reported a point exchange notice they did not recognize, and the attack came to light. [1] [3]

3. 2020-09-23

   Public disclosure. [2] [3]

1,269 accounts were logged in to, and their names, birth dates and genders may have been seen. In one case 3,100 points were exchanged for another company's points; 6 more exchange requests were stopped before they completed. [1] [3]

About 2.9 million people, mostly in Kyushu, are registered on the site. [2]

The attacking IP addresses were blocked and some point exchanges were stopped. The 7 members with exchange requests were called, the 1,262 others were emailed to change their passwords, and members were told not to reuse passwords. [1] [3]