Nulab: a password list attack on Nulab accounts for Backlog, Cacoo and Typetalk made about 100,000 attempts and logged in to about 760 accounts

1. 2020-12-05

   From this day to the 8th, logins to Nulab accounts were attempted about 100,000 times with mail address and password pairs that seem to have been obtained elsewhere. [1] [2] [3]

2. 2020-12-09

   From around 18:00, the company began invalidating the passwords of accounts it confirmed were hit and mailed those users asking them to reset. [1] [2]

3. 2020-12-10

   The company disclosed the case. [1] [2]

Of the mail addresses tried, about 1,500 belonged to existing accounts, and about 760 of those were logged in to. For those accounts, information that the user can see after logging in may have been viewed. Payment data such as card numbers was not included, and there was no sign passwords were changed. [1] [2]

The company said no customer data including passwords leaked from Nulab and believes the credentials used were leaked at other sites. It asked users to turn on two-step verification and login alerts and to stop reusing passwords. [1] [3]