> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

SUNDRUG: its online store "SUNDRUG e-shop" and a customer site were hit by a credential stuffing attack, 19,057 member accounts were logged in without authorization and member data may have been viewed

From July 9 to 11, 19,057 member accounts were logged in from overseas without authorization, and some members' data may have been viewed.

Disclosed

2022-07-12

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A list-type attack began from overseas IP addresses, using IDs and passwords that may have leaked from other companies' services. [1]

  2. It learned of the attack at 10:30 a.m. from a report by its system contractor. It blocked access from overseas, emailed the members concerned the same day and asked them to change their passwords. [1] [2]

  3. It announced the case. [1] [2]

Impact

There were 19,057 unauthorized logins from July 9 to 11. For some members, the name, address, phone number, email address, password, birth date, purchase history and points held may have been viewed. Of the credit card, only the first six and last two digits could be seen. [1]

Timeline

  1. Started 2022-07-09
  2. Detected 2022-07-11
  3. Disclosed 2022-07-12
  4. 3 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Date of birth][Passwords][Purchase history]

Organizations involved

Open in organization search

Sources

  1. [1][Official]サンドラッグ e-shop 本店及びサンドラッグお客様サイトへの不正ログインについてのお詫びとお知らせSUNDRUG CO., LTD. · 2022-07-12
  2. [2][News]サンドラッグ、EC会員約2万人に不正アクセス - 日本経済新聞Nikkei · 2022-07-12