Yayoi: its single sign-on integration server was accessed without authorization, and Yayoi IDs and passwords of 18,364 users who set up integrations or tried to log in may have been stolen, while login tokens of 585,341 users were exposed

1. 2021-05-10 10:00

   From around this time until about 19:00 on June 16, the Yayoi IDs and passwords of users who set up integrations with Yayoi's account linking, Misoca and other companies' services were in a state where they may have been stolen. [1]

2. 2021-05-18

   An unintended account was created on the domain controller from an IP address in Latin America. Another was created on the 25th. [1]

3. 2021-05-19

   From shortly before 0:00 on this day until about 19:00 on June 16, a third party could view the single sign-on access tokens held temporarily at login. [1]

4. 2021-05-24

   From late at night until 7:00 the next day, the security system detected and removed suspicious activity. [1]

5. 2021-06-16

   Around 19:00 on this day, the period covered by the unauthorized access ended. [1]

6. 2021-06-22

   It resolved the problem and announced the case. [1] [2]

7. 2021-06-24

   It said that the logs showed no trace of a leak and no abuse of the information that might have leaked. [1]

8. 2021-06-30

   Saitama Resona Bank announced that, because of the unauthorized access to Yayoi's authentication integration service, login information might leak when linked with the bank's My Gate. [3]

9. 2021-07-09

   It corrected the number of users who set up integrations from 17,137 to 18,104 after an investigation found more people. Of the 967 newly found, 331 set up integrations during the period and 636 entered a wrong ID or password or tried to access with an unregistered ID. [4]

10. 2021-09-27

    It published a final report. Yayoi IDs and passwords that may have been seen by a third party total 18,364: 17,504 who set up integrations, 600 who entered a wrong Yayoi ID and similar, and 260 who entered a number thought to be a customer number. [5]

A monthly regular inspection found a suspicious account created on the domain controller, the access was traced to the integration server, and further investigation showed that information may have leaked. Accesses embedding a malicious script with commands that read files on the integration server were made. Yayoi changed the passwords of the users concerned, notified them of temporary passwords by email and asked them to set new passwords and be careful about reusing passwords. It isolated the domain controller from the network and is investigating the cause and damage. [1] [2]

The final report put the total at 18,364: 17,504 who set up integrations, 600 who entered a wrong Yayoi ID and similar, and 260 who entered a number thought to be a support customer number. The password reset rate was 93.5% as of September 15. [5]