Quick: "Kangoroo!" suffered a password-list attack and points were misused in 1,877 accounts

1. 2022-04-10

   A later investigation found that the credential stuffing attack had begun on this day. [2]

2. 2022-05-16

   Inquiries from users at 9:36 a.m. revealed suspicious activity. The same day it confirmed login attempts and misuse of points, and stopped the site at 12:00. [1]

3. 2022-05-19

   It announced the case. [1]

4. 2022-05-20

   It reset the passwords of all members. [1]

5. 2022-05-23

   The site reopened. [1]

6. 2022-06-29

   It received the investigation report on the damage from a third-party body. [2]

7. 2022-07-06

   It published the investigation results in a third report. [2]

A password-list attack using IDs and passwords leaked from other services let attackers misuse points in 1,877 accounts. [1]

A third-party investigation found that the credential stuffing attack ran from April 10 to May 16, with 68,821,639 unauthorized login attempts, 27,196 accounts actually logged in, 1,878 accounts whose points were misused and 652,004 points misused. The 1,877 accounts given in May became 1,878. [2]