> JapanHacked_
[Resolved][Severity: Critical][Credential abuse]

Kyash: accounts opened in other people's names were linked to their bank accounts and topped up from Japan Post Bank and AEON Bank

Third parties opened Kyash wallets in account holders' names and linked their bank accounts with stolen details to top up the wallets. Four cases cost 530,000 yen.

Disclosed

2020-09-16

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

Third parties who did not own the accounts opened Kyash wallets in the holders' names, linked the bank accounts with illegally obtained account and personal details, and topped up. Japan Post Bank had 3 cases worth 230,000 yen and AEON Bank 1 case worth 300,000 yen. [1]

Kyash denied any leak from its own systems and stopped new links and top-ups from both banks. It said it would repay everything after talks with the banks. The method resembled NTT DOCOMO: criminals linked other people's bank accounts to docomo Koza wallets and drained deposits at 11 banks at the same time. [1]

Timeline

  1. Disclosed 2020-09-16
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Fraud][Financial loss]
Entry point
Stolen credentials

Data exposed or at risk

[Bank account]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]ウォレットサービス「Kyash」で複数連携金融機関より不正チャージが発生Security NEXT · 2020-09-16