> JapanHacked_
[Resolved][Severity: Moderate][Credential abuse]

Gunma University: one user's account on a mail server was accessed without authorization and used to send about 570,000 spam emails

From September 21 to 24, one account on an independently run mail server was abused to send 570,364 spam emails. No damage was confirmed.

Disclosed

2021-10-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Around 00:48, spam sending began through unauthorized access to one account on a mail server run separately from the university-wide mail system. It was sent again from about 19:00 on the 22nd to about 06:00 the next morning, and from about 06:00 to 11:35 on the 24th. [1] [2]

  2. It announced the case. [1] [2]

Impact and measures

The spam totaled 570,364 emails to 330,723 addresses. The attacked server now blocks access from outside the university and will be retired as soon as possible. [1]

Timeline

  1. Started 2021-09-21
  2. Detected 2021-09-24
  3. Disclosed 2021-10-20
  4. 29 days

Attack or cause

Method
[Credential abuse]
Impact
Entry point
Stolen credentials

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスによる迷惑メール送信のお詫びについてGunma University · 2021-10-20
  2. [2][News]群馬大学のメールサーバが踏み台に、約57万件の迷惑メールを送信ScanNetSecurity · 2021-10-25 08:05