> JapanHacked_
[Resolved][Severity: Critical][Credential abuse]

Wellnet: impostors topped up the Shiharai Hisho payment app from 35 bank accounts, and about 2.7 million yen may have been spent

A review of all transactions since launch found suspected impostor top-ups from 35 bank accounts worth 4.32 million yen, all made before September 2019.

Disclosed

2020-09-17

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

A review of the whole period since the August 2017 launch found, as of September 16, suspected impostor top-ups from 35 accounts totaling 4,319,574 yen. Fraud controls blocked 1,623,134 yen, but the remaining 2,696,440 yen may have been spent, and the accounts were frozen. [1]

All of these top-ups were made before September 2019, and the company said no suspicious transactions had been seen since. At the end of August 2020 the service was linked to 37 financial institutions. [1]

Timeline

  1. Disclosed 2020-09-17
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Fraud][Financial loss]
Entry point
Stolen credentials

Data exposed or at risk

[Bank account]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]スマホ決済「支払秘書」でなりすましによる不正チャージSecurity NEXT · 2020-09-17