Kyash: accounts opened in other people's names were linked to their bank accounts and topped up from Japan Post Bank and AEON Bank
Third parties opened Kyash wallets in account holders' names and linked their bank accounts with stolen details to top up the wallets. Four cases cost 530,000 yen.
Disclosed
2020-09-16
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
Third parties who did not own the accounts opened Kyash wallets in the holders' names, linked the bank accounts with illegally obtained account and personal details, and topped up. Japan Post Bank had 3 cases worth 230,000 yen and AEON Bank 1 case worth 300,000 yen. [1]
Kyash denied any leak from its own systems and stopped new links and top-ups from both banks. It said it would repay everything after talks with the banks. The method resembled NTT DOCOMO: criminals linked other people's bank accounts to docomo Koza wallets and drained deposits at 11 banks at the same time. [1]
Timeline
- Disclosed 2020-09-16
- 1 days
Attack or cause
- Method
- [Credential abuse]
- Impact
- [Fraud][Financial loss]
- Entry point
- Stolen credentials
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, MinatoFinance and insurance
Kyash Inc.
Sources
- [1][News]ウォレットサービス「Kyash」で複数連携金融機関より不正チャージが発生Security NEXT · 2020-09-16