> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Hard Off: unauthorized logins hit its official app, member data may have been viewed in 6,186 logins, and the service was stopped temporarily

From August 9 to 11, 6,186 logins came from a specific IP address and some may have been unauthorized. The service was stopped and all passwords were reset.

Disclosed

2022-08-13

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Login attempts began from a specific IP address. [1]

  2. At 4:50 p.m. it confirmed that unauthorized logins had succeeded and stopped the service. [1]

  3. It fixed the cause, reset all passwords and reported to the police. [1]

  4. It resumed the service at 3 p.m. and announced the case. [1]

Impact

There were 6,186 logins from August 9 to 11, some of which may have been unauthorized. Besides email addresses and passwords, registered members' names, addresses, phone numbers, genders, birth dates and occupations may have been viewed. The app holds no card data. [1]

Timeline

  1. Started 2022-08-09
  2. Detected 2022-08-11
  3. Disclosed 2022-08-13
  4. 4 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak][Service outage]
Entry point
Stolen credentials

Data exposed or at risk

[E-mail address][Passwords][Name][Postal address][Phone number][Gender][Date of birth][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][Official]ハードオフ公式アプリにおける不正ログインに関するお詫びとご報告 | 中古品の買取・販売ならハードオフ(楽器・家電・家具など取扱商品多数のリサイクルショップ)Hard Off Corporation Co., Ltd. · 2022-08-13