[Resolved][Severity: Moderate][Intrusion]

Kita-Osaka Kyuko Railway: its website's COVID-19 notice page was defaced with a link to an online casino ad page

The admin login page was open to the internet, and a COVID-19 notice page stayed defaced from August 31 to September 16. No personal data leak was found.

Disclosed

2020-09-28

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-08-31 18:41
An intruder altered the page, adding text and a URL leading to an unrelated site. [1]
2020-09-16 18:00
At about this time, the defacement was noticed. [1]
2020-09-16 18:28
The altered part was removed and fixed. [1]
2020-09-28
Public disclosure. [1] [3]

Impact and response

The link led to a Japanese page promoting an online casino. The page was viewed 114 times in the period, more than half on September 16, the day it was found, which the company believes were largely its own staff. Access to the admin screen was restricted, and visitors who may have followed the link were asked to scan for malware. [1] [2]