> JapanHacked_
[Investigating][Severity: Major][Phishing]

Yaizu City: its deep sea water facility contractor fell for a tech support scam, and data of about 15,000 people may have leaked

A contractor employee at the facility fell for a tech support scam and the PC was remotely controlled. Names, addresses and phone numbers of about 15,000 users may have leaked.

Disclosed

2024-03-21

Organizations involved

1

Leaked or at risk

15K

15,000

Downtime

Unknown

What happened

  1. An employee of the federation that manages the facility called the number shown after a virus warning appeared on the PC and followed the instructions. About 320,000 yen was paid. [1]

  2. Another employee started the PC and saw an unfamiliar screen suggesting remote control, which revealed the problem. The city judged that information may have leaked. [1]

  3. It announced the case. It asked specialists to analyse the logs and will notify the people concerned. [1] [2]

Impact

Names, addresses, phone numbers, registration dates and registration numbers of about 15,000 people who registered to use the facility may have leaked. Credit card numbers and the like are not included. [1]

Timeline

  1. Started 2024-03-14
  2. Detected 2024-03-15
  3. Disclosed 2024-03-21
  4. 7 days

Attack or cause

Method
[Phishing]
Impact
[Data leak]
Entry point
Remote access

Data exposed or at risk

[Name][Postal address][Phone number]

Organizations involved

  • [Breached][Major]Shizuoka, YaizuMunicipality15,000 leaked

    Yaizu City

    The PC of an employee of the Shizuoka Federation of Fisheries Processing Cooperatives, which the city contracts to manage the facility, was hit.

Open in organization search

Sources

  1. [1][News]焼津市、深層水の購入者1万5000人の個人情報漏えいか　原因は「サポート詐欺」ITmedia NEWS · 2024-03-21
  2. [2][News]焼津市でサポート詐欺被害、約 15,000 件の登録者情報が漏えいした可能性ScanNetSecurity · 2024-03-29 08:05