[Resolved][Severity: Major][Credential abuse]

TEPCO Energy Partner: a password list attack on the Kurashi TEPCO web member site may have led to 260 unauthorized logins

Mail addresses and passwords leaked elsewhere were used, and names, addresses and electricity usage may have been viewed. Passwords of all members were reset.

Disclosed

2020-10-13

Organizations involved

Leaked or at risk

260

Downtime

Unknown

What happened

2020-10-05
From around this day, a third party tried tens of thousands of member sign-ups with a list of mail addresses, and owners received many sign-up mails they had not requested. By the 11th, 260 logins appeared to be by someone other than the member. [1] [2]
2020-10-13
The company disclosed the case and reset the passwords of all members. [2]

How it worked and the response

The sign-up page showed an error when an already registered address was entered. The company said it was still checking the link but that the page may have been used to find existing accounts. [1]

New sign-ups and, as a precaution, the point service were stopped. No point redemptions by attackers were found. All member passwords were reset, and security upgrades were planned for November. [1]