Future-In: the CMS servers behind council broadcast services were accessed without authorization and the council web services of about 90 municipalities were stopped

1. 2023-04-09

   The server access logs recorded a large number of accesses from outside. [1]

2. 2023-04-11

   During maintenance of the Yokohama City Council internet broadcast system it detected an anomaly, and at 18:49 it stopped that server. At night it checked the other seven servers and found traces of intrusion on another server. [1]

3. 2023-04-12

   Around 6:30 it stopped all eight servers. Four services for about 90 municipalities, including the council broadcast system, were stopped. [1] [2]

4. 2023-04-14

   It finished its measures and is restarting the services in turn after coordinating with each municipality. [1] [2]

The servers hit were those of the CMS behind the council broadcast and other websites used by municipalities across Japan. The company ran four systems for about 90 municipalities on eight servers in its data center. The cause was a brute-force attack on the ID and password used to log in to the CMS, which stole them and let the attacker in. There were traces of suspicious files being placed, but customer data was reportedly not altered. [1]