> JapanHacked_
[Resolved][Severity: Moderate][Credential abuse]

Tokyu Recreation: a mail account password was stolen and abused, and suspicious mail was sent to customers under the 109 Cinemas name

Customers it had written to before received English mail with a ZIP attachment that pretended to be a reply. The company asked them to delete such mail unopened.

Disclosed

2020-12-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Mainly between midnight and about 10:00, mail with English text and a ZIP attachment was sent from an address for the Futako-Tamagawa cinema to customers the company had written to before, pretending to be its reply. [1] [2]

  2. The company announced the case and warned people. [1] [2]

Cause and response

A third party stole the passwords of some mail accounts the company uses and abused them. The company changed the passwords to stronger ones, and no further misuse has been seen. The account will be deleted once the damage check is done. [1] [2]

Timeline

  1. Started 2020-12-03
  2. Disclosed 2020-12-04
  3. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Fraud]
Entry point
Stolen credentials

Data exposed or at risk

[E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスによる迷惑メール送信に関するお詫びと注意喚起についてTokyu Recreation · 2020-12-04
  2. [2][News]109シネマズから不審メール送信、不正アクセスでメールアカウントが踏み台にScanNetSecurity · 2020-12-08 08:00