Niigata Prefecture: the mail server of its civil engineering disaster information system was accessed without authorization and used to send malicious email

1. 2022-01-22

   From 10:56 am, malicious mail started to be sent from the mail server. Sending continued until 10:18 pm on January 24. [2]

2. 2022-01-25

   It found that the mail server of its civil engineering disaster information system had been accessed without authorization, with traces of malicious email sent outside. It stopped the server temporarily until it could prevent unauthorized access. The content of the emails and the time and cause of the access were under investigation. [1]

3. 2022-02-07

   It published the investigation result and countermeasures. [2]

The mail server could be used to send mail from outside the prefectural office and the password of the mail address was weak, so it was abused. 311,871 malicious messages were sent (including 123,434 send errors) under nine subject lines including "Congratulations Lucky Winner!". No data on the mail server or other servers was altered and no personal data leaked. It changed settings so the mail server cannot be used from outside, retired the abused address and resumed using the server. [2]