[Resolved][Severity: Moderate][Credential abuse]

Katsushika Ward: an old mail account unused for over ten years was taken over and used to send unwanted email to 827 unspecified addresses abroad

A mail account used before the move to LGWAN was accessed without authorization and used for unwanted sending on 16 days from December 2020 to February 2021.

Disclosed

2021-03-12

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-12-05
From this day to February 17, 2021, unwanted email was sent from the old mail account on 16 days. [1]
2021-03-12
The ward announced the case. Its contractor changed the passwords and deleted unused addresses; the ward planned to file a damage report with the police. [1]

Impact

The account dated from before the move to the Local Government Wide Area Network (LGWAN) in the early 2000s and had gone unused. The email went to 827 unspecified addresses abroad on domains such as .gov, .com and .uk. Its content is unknown. [1]

Of the 16 addresses on the old domain, only one was abused; logs showed the others were not. How the password was obtained is unknown. [1]