> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Nagoya University: the mail accounts of two teachers were accessed without authorization and abused to send spam in bulk

Two graduate-school teachers' mail accounts were accessed from abroad and used to send spam. Grade data on 36 students may have been viewed.

Disclosed

2021-10-29

Organizations involved

1

Leaked or at risk

36

36

Downtime

Unknown

What happened

  1. Unauthorized access to a teacher's account at the Graduate School of Education and Human Development began. It lasted until September 23. [1]

  2. Unauthorized access from several overseas IP addresses to a teacher's account at the Graduate School of Science began. It lasted until March 18. [1]

  3. It detected a large volume of mail sent from the Graduate School of Science account, and the problem came to light. [1] [2]

  4. Unauthorized access to the teacher's account at the Graduate School of Education and Human Development occurred again, lasting until May 28. [1]

  5. It confirmed that a large volume of spam was being sent from the account. [1]

  6. It announced the case. [2]

Impact

The Graduate School of Science account held one password-protected file, saved as a mail attachment, with the names, student numbers and grades of 36 students in a lecture. Mails containing personal data may have been viewed. Both accounts were abused to send spam in bulk. [1] [2]

Timeline

  1. Started 2020-07-23
  2. Detected 2021-03-18
  3. Disclosed 2021-10-29
  4. 463 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Education]

Organizations involved

Open in organization search

Sources

  1. [1][News]複数教員のメールアカウントに不正アクセス - 名古屋大Security NEXT · 2021-11-01
  2. [2][News]名古屋大学教員のメールアカウントへの不正アクセス、2つの事案を確認ScanNetSecurity · 2021-11-01 08:05