> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Yomiuri Shimbun Online: about 30,000 logins hit its member system, personal data of up to 7,441 people may have been viewed, and passwords were invalidated

From the evening of July 2 to the evening of July 4, about 30,000 logins, legitimate ones included, were seen, and personal data of up to 7,441 people may have been viewed.

Disclosed

2022-07-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From about 5:40 p.m., unauthorized logins began on the member system. [1] [2]

  2. By about 5 p.m., about 30,000 logins, legitimate ones included, had been recorded. The registered passwords were invalidated, the members concerned were emailed and asked to reset them. The newspaper announced the case in an article at 9:45 p.m. [1] [2]

  3. It issued a follow-up saying personal data of up to 7,441 people may have been viewed. [2]

Impact

Logging in requires an ID and a password. Personal data of up to 7,441 people may have been viewed. The items viewed are not stated in the sources checked. [2]

Timeline

  1. Started 2022-07-02
  2. Detected, Disclosed 2022-07-04
  3. 2 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]読売新聞オンラインに不正アクセス、一部会員のパスワード無効化で対応 : 読売新聞The Yomiuri Shimbun · 2022-07-04
  2. [2][News]「読売新聞オンライン」への不正アクセス、最大7,441件の個人情報が閲覧された可能性ScanNetSecurity · 2022-07-14 08:05