[Resolved][Severity: Major][Credential abuse]

HJ Holdings: password list attacks on the Hulu streaming service led to 798 unauthorized logins

IDs and passwords leaked elsewhere were used, and unauthorized logins went on from late September. Names, birth dates, mail addresses and partial payment data may have been viewed.

Disclosed

2020-10-09

Organizations involved

Leaked or at risk

798

Downtime

Unknown

What happened

2020-09-23
779 unauthorized logins took place. [1]
2020-09-26
18 unauthorized logins took place. [1]
2020-10-01
One more unauthorized login took place. [1]

Impact and response

In the affected accounts, profile data such as name, birth date and gender, the mail address, part of the payment details and the watch list may have been viewed, and videos may have been watched. [1]

The company blamed IDs and passwords obtained elsewhere and denied a leak from its own systems. It restricted access from the attacking IP addresses and forced password resets on the affected accounts. [1]