Okasan Online Securities: a password list attack on its trading tool logged in to 208 customer accounts
A password list attack from one IP address against the trading tool from September 15 to 17 got into 208 accounts. No assets were sold or withdrawn.
Disclosed
2020-09-23
Organizations involved
1
Leaked or at risk
208
208
Downtime
Unknown
What happened
A customer reported an account lock they had not caused. A password list attack from a single IP address had hit the trading tool from September 15 to 17, and as of 3 p.m. on September 18, 208 accounts had been logged in to. [1]
No sales or withdrawals were found. The company said the IDs and passwords came from elsewhere and denied any leak of its own. Accounts lock after 10 failed tries; other accounts were also locked, but the company did not give a number. [1]
The company was merged into Okasan Securities Co., Ltd. in January 2022.
Timeline
- Started 2020-09-15
- Disclosed 2020-09-23
- 8 days
Attack or cause
- Method
- [Credential abuse]
- Impact
- [Data leak]
- Entry point
- Stolen credentials
Data exposed or at risk
–
Organizations involved
[Breached][Major]Tokyo, ChuoFinance and insurance208 leaked
Okasan Online Securities Co., Ltd.
Sources
- [1][News]岡三オンライン証券にPWリスト攻撃 - 資産売却や出金被害は未確認Security NEXT · 2020-09-23