Ehime University: two faculty mail accounts were abused to send about 35,000 spam messages

1. 2020-11-27 01:00

   Around this time, two accounts of the faculty mail service were accessed without authorization and spam began to go out. [1]

2. 2020-11-30 08:00

   By around this time, about 35,000 spam messages had been sent. [1]

3. 2021-01-05

   The university disclosed the case. [1]

How the attacker learned the passwords is not known. The two affected accounts used the same mail address and password to sign up for an outside event management service, and the university thinks they may have leaked when that service was attacked and then been abused. [1]

There were also signs that the same attacker had attacked the university's own systems, but they caused no damage. The university said no personal data leaked, and that it would strengthen mail security and account management. [1]