> JapanHacked_
[Contained][Severity: Major][Credential abuse]

ETC Usage Inquiry Service: mass access from overseas IP addresses, and some accounts were logged in without authorization

From September 30 to October 2 there was mass access from overseas IP addresses, and some accounts whose ID and password matched were logged in. The count has not been published.

Disclosed

2023-10-04

Organizations involved

6

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From this day until October 2, there was mass access to the service from overseas IP addresses, and in some of it the ID and password matched and the account was logged in. [1] [2]

  2. The six operating companies announced the case jointly. They took a measure to block access from an IP address at once if similar mass access occurs, and are notifying the customers concerned individually by email. [1] [2]

Impact

For the accounts that were logged in, the email address, registered ID, secret question and answer, and usage history may have been viewed. ETC credit card numbers and on-board unit management numbers cannot have leaked. The number of accounts concerned has not been published. [1] [2]

Timeline

  1. Started 2023-09-30
  2. Detected 2023-10-02
  3. Disclosed 2023-10-04
  4. 4 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[E-mail address][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]ETC利用照会サービスサイトへの不正アクセス・ログインについてのお詫びとお知らせEast Nippon Expressway Co., Ltd. and five other expressway companies · 2023-10-04
  2. [2][News]「ETC利用照会サービス」が不正ログイン被害、海外 IP アドレスから大量のアクセスScanNetSecurity · 2023-10-16 08:05