Shokei Gakuin: a staff email account of Shokei Gakuin University was taken over from abroad and used to send 1,639 spam emails, and 1,634 stored emails may have been viewed
A staff email account was taken over from abroad and used to send 1,639 spam emails. 1,634 stored emails may have been viewed.
Disclosed
2021-05-27
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
From around this time, a staff account was accessed from abroad, and spam emails began to be sent inside and outside the university. [1]
Around this time, the account was stopped. 1,639 spam emails had been sent. Inquiries saying spam from the same account had arrived revealed the damage. [1]
Shokei Gakuin announced the case and sent the people concerned an apology and a warning by email. [1] [2]
Impact
The spam was a few lines of English posing as a prize notice with a zip file attached, and it held no content or proper nouns related to Shokei Gakuin. 1,634 emails stored in the account's mailbox may have been viewed: 1,552 exchanged inside the university, including 1,475 with faculty and staff and 77 with students, and 82 with outside companies. All were administrative messages, and the foundation said they held no confidential information. How the password was stolen is not known. The password had been set to a complex string. [1]
Timeline
- Started 2021-04-26
- Detected 2021-04-27
- Disclosed 2021-05-27
- 31 days
Attack or cause
- Method
- [Credential abuse]
- Impact
- [Data leak]
- Entry point
- Stolen credentials
Data exposed or at risk
Organizations involved
[Breached][Major]Miyagi, NatoriEducation and learning support1,634 leaked
Shokei Gakuin Educational Foundation
Sources
- [1][News]職員アカウントが海外より不正アクセス、スパムの踏み台に - 尚絅学院大Security NEXT · 2021-06-07
- [2][News]職員アカウントが迷惑メールの踏み台、全宛先に注意喚起と謝罪メール送信ScanNetSecurity · 2021-06-07 08:00