[Resolved][Severity: Major][Intrusion]

Fukuoka Prefecture: the mail server of the sea condition data system of its Fisheries and Marine Technology Center was accessed without authorization and abused to send about 200,000 spam emails a day

A mail server that still used a weak password from development was abused as a spam relay. No personal information leaked.

Disclosed

2021-03-31

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2021-03-27
About 40,000 unintended spam emails were sent from an address that included the Kaikyo Navi Fukuoka domain. From the next day, about 200,000 a day were sent. [2]
2021-03-29
The prefecture noticed the damage because the observation emails were delayed. [2]
2021-03-31
The prefecture announced the case. [1]

Impact and cause

The system delivers sea condition data to support seaweed farmers and others. The prefecture had commissioned it from an outside firm, and it was delivered in March and had only just started running. Logs showed traces of attempted unauthorized access even in the development stage before delivery. [2]

The cause appears to be that a weak password used during development was left in place. Only the mail server was accessed, no personal information leaked, and no access to other systems such as the Kaikyo Navi Fukuoka website was confirmed. The prefecture changed the password, cut off access temporarily and investigated. The seaweed season runs from October to past March, and the prefecture said there was no effect on the business. [1] [2]