[Resolved][Severity: Major][Phishing][Credential abuse]

Shinsei Financial: 36 members of its Lake ALSA card loan service were logged into without authorization, and 23 suffered fraud such as illegal ATM withdrawals

Member numbers and PINs were stolen, mainly by phishing, and used to log in to the member service, leading to illegal withdrawals and repayments.

Disclosed

2021-03-05

Organizations involved

Leaked or at risk

Downtime

Unknown

What happened

2020-12-08
The company suspended web repayment through Pay-easy. [1]
2020-12-23
The company suspended withdrawals through the smartphone ATM. [1]
2021-03-05
The company announced the unauthorized logins and fraudulent transactions on its member service. [1] [3]

Impact

In November 2020, several users reported loans they did not recognize. The company found illegal withdrawals through the official app's smartphone ATM and fraudulent web repayments through Pay-easy. [1] [2]

There were unauthorized logins on 36 accounts: 16 had their member numbers and PINs stolen by phishing by SMS or email, and the method for the other 20 is unknown. 23 members suffered fraudulent transactions: 21 illegal withdrawals and 7 fraudulent web repayments (5 overlapping). [1] [2]

A login exposed names, birth dates, member and card numbers, addresses, workplaces, annual income, linked bank accounts, transaction history and balances. The company is processing compensation for the losses. [1]