Tohoku Institute of Technology: an email account was accessed without authorization, spam was sent to unspecified recipients abroad, and the mail of 1,042 people may have been read
Access control of a cloud authentication service failed under certain conditions, and a researcher's mail was abused. Data on 1,042 people may have been seen.
Disclosed
2021-06-30
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
From this day until February 24, 2021, a visiting researcher's email account was abused, and 19,830 spam emails were sent to unspecified recipients abroad, of which 538 were delivered. [1]
The unauthorized access was detected. [1]
It announced the case. [1]
Cause and impact
Access control set up in the cloud authentication service did not work under certain conditions. The mailbox contents may have been read for 1,042 people: 600 staff, 71 students and 371 people outside the university. [1]
Timeline
- Started 2020-11-09
- Detected 2021-02-24
- Disclosed 2021-06-30
- 233 days
Attack or cause
- Method
- [Credential abuse]
- Impact
- [Data leak]
- Entry point
- Stolen credentials
Data exposed or at risk
Organizations involved
[Breached][Major]Miyagi, Sendai, Taihaku-kuEducation and learning support1,042 leaked
Tohoku Institute of Technology
Sources
- [1][News]東北工業大学のメールアカウントに不正アクセス、特定の条件下でクラウド認証サービスで設定したアクセス制御が機能せずScanNetSecurity · 2021-07-02 08:00