> JapanHacked_
[Contained][Severity: Major][Credential abuse]

IIBC: the "TOEIC application site" was logged into with IDs and passwords from other services, and some members' data may have been viewed

From January 8 there were logins using IDs and passwords obtained from other services, and some members' names and addresses may have been viewed.

Disclosed

2023-01-11

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Unauthorized access by a third party began, using user IDs and passwords obtained from services other than the association's. [1] [2]

  2. It announced the case. It suspended the accounts that may have been logged into and told the members whose data may have been viewed individually. [1] [2]

Impact

The data that may have been viewed is the registered ID, name, birth date, sex, address, phone number and email address, and for those who registered it, country of origin, native language and the secret question and answer. Application history, test results and credit card data were not viewed. The number of people has not been published. [1]

Timeline

  1. Started 2023-01-08
  2. Disclosed 2023-01-11
  3. 3 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][Date of birth][Gender][Postal address][Phone number][E-mail address][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]TOEIC申込サイトへの不正アクセスのご報告およびアカウント管理に関するお願い（2023.01.11）｜インフォメーション｜IIBCThe Institute for International Business Communication · 2023-01-11
  2. [2][News]「TOEIC申込サイト」にパスワードリスト型攻撃、住所氏名や秘密の質問と回答他が閲覧された可能性ScanNetSecurity · 2023-01-13 08:05