[Resolved][Severity: Critical][Credential abuse]

Mynavi: a password list attack hit its job site Mynavi Tenshoku, and the web résumés of 212,816 users may have been viewed

Between January 17 and February 9, 2021, accounts were logged into with passwords that seem to have been obtained elsewhere. Passwords of all users were reset.

Disclosed

2021-02-12

Organizations involved

Leaked or at risk

212.8K

212,816

Downtime

Unknown

What happened

2021-01-17
From this day, logins using passwords that seem to have been stolen elsewhere began. [1] [4]
2021-02-09
The company confirmed unauthorized logins to its web server. It blocked traffic from the group of IP addresses that attempted them and strengthened its defenses. [1] [4]
2021-02-12 16:00
It reset the passwords of the users hit by the logins and told them individually by mail. It disclosed the case the same day. [1] [2]
2021-02-13 00:00
It reset the passwords of all other users as well. [1] [2]
2021-02-16
It opened a help line for users and began taking phone inquiries. [3]

Impact

The affected are the web résumés of 212,816 users registered since 2000, former members excluded, out of about 6.4 million users at the end of January 2021. The résumés may have been viewed, but the company said it had no report of misuse of personal data as of February 12. [1] [2] [4]

The company notified and consulted the police and reported to the Personal Information Protection Commission and others. It said it would raise security beyond ID and password authentication. [1] [2]