> JapanHacked_
[Resolved][Severity: Moderate][Credential abuse]

Sapporo Nissin Electronics: someone logged into the app used to update its website without authorization and placed a page for phishing

An unauthorized login to the site update app placed a phishing page. No personal data leaked.

Disclosed

2021-07-12

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The site update app was logged into without authorization and a page for phishing was placed. [1]

  2. The company noticed and closed the site at 18:00. [1]

  3. It reopened the site and announced the case. [1]

Impact

No personal data was stored on the site. The parent company is Nippon Signal. [1]

Timeline

  1. Started 2021-05-25
  2. Detected 2021-05-26
  3. Disclosed 2021-07-12
  4. 48 days

Attack or cause

Method
[Credential abuse]
Impact
[Site defacement]
Entry point
Stolen credentials

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]サイト更新用アプリケーションに不正ログイン、フィッシング目的のページ設置の改ざん被害ScanNetSecurity · 2021-07-15 08:00