> JapanHacked_
[Resolved][Severity: Critical][Credential abuse]

Brother Sales: unauthorized logins on its member site "Brother Online" affected up to 126,676 accounts

A list-type attack may have logged into up to 126,676 accounts. Points were exchanged in 683 accounts.

Disclosed

2022-05-10

Organizations involved

1

Leaked or at risk

126.7K

126,676

Downtime

Unknown

What happened

  1. It stopped the service after unauthorized logins. [1]

  2. It announced the case. [1]

  3. It reset the passwords and resumed the service. The investigation found no leak from its own servers. [2]

Impact

A list-type attack may have logged into up to 126,676 accounts. Points were exchanged in up to 683 accounts, worth up to ¥404,900. Once logged in, registered information (name, birth year, email address, phone number and so on) could be viewed. [2]

Timeline

  1. Started, Detected 2022-05-06
  2. Disclosed 2022-05-10
  3. 4 days

Attack or cause

Method
[Credential abuse]
Impact
[Fraud][Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][E-mail address][Phone number][Date of birth]

Organizations involved

Open in organization search

Sources

  1. [1][Official]会員向けサービスサイト「ブラザーオンライン」における不正ログインの発生についてBrother Sales, Ltd. · 2022-05-10
  2. [2][Official]「ブラザーオンライン」における不正ログインの調査結果および対策 サービス再開時期についてのお知らせBrother Sales, Ltd. · 2022-05-18