> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

KOKUYO: its dealer search site was tampered with and visitors were sent automatically to suspicious outside sites

On its dealer search site, visitors were sometimes sent automatically to suspicious sites. The company closed the site temporarily on May 20.

Disclosed

2021-05-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The site appears to have been tampered with from around this day. [3]

  2. A user inquired that they had been redirected to a suspicious site, and the problem came to light. [1]

  3. Because the site might have been tampered with by a third party, the company closed it temporarily and announced the case. [1] [2]

  4. It compiled its findings and said the tampering lasted about ten months, from July 16, 2020 until the site was closed on May 19, 2021. It explained that server management and security measures had been insufficient, and said it was moving the server and rebuilding the site, expecting recovery by the end of July. [3]

Impact

On the site, used by consumers and businesses to find shops selling KOKUYO stationery and furniture, visits led automatically to outside sites, and the destination changed with each visit. The company confirmed that visitors were rarely sent to what looked like a scam page saying "You won" or to a dangerous page that browsers warn about. It said it would report again once the investigation results were known. [1] [2]

Timeline

  1. Detected 2021-05-19
  2. Disclosed 2021-05-20
  3. 1 days

Attack or cause

Method
[Intrusion]
Impact
[Site defacement]
Entry point
Unknown

Data exposed or at risk

–

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]取扱販売店検索サイトが改ざん被害、外部サイトに誘導 - コクヨSecurity NEXT · 2021-05-24
  2. [2][News]コクヨ取扱い販売店検索サイトから不審サイトに自動遷移、Web改ざんの可能性ScanNetSecurity · 2021-05-27 08:00
  3. [3][News]コクヨ販売店の検索サイト改ざん、2020年7月に発生Security NEXT · 2021-06-04