> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

LY Corp: credential stuffing on LINE Business IDs hijacked 688 official accounts, exposing friends' chats and other data

Credential stuffing on LINE Business IDs hijacked official accounts, letting attackers see friends' profiles and one-to-one chats and send suspicious messages.

Disclosed

2024-08-26

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Credential stuffing attacks on LINE Business IDs began. They continued several times until July 18. [1]

  2. It detected a rise in failed logins, and an investigation found unauthorized logins and operations by the attacker. It reset the passwords of the IDs under suspicion. [1]

  3. It announced the case. 688 accounts were logged into without authorization, and none had two-step verification set, it was reported. [1] [2] [3]

Impact

The unauthorized logins took place on business accounts that use only an email address. The attacker could see friends' profile information and one-to-one chat content shown in the official account admin screen. Administrators' addresses, phone numbers and email addresses may also have been viewed. No unauthorized login was confirmed on IDs used only with a LINE account. [1]

Timeline

  1. Started 2024-07-10
  2. Detected 2024-07-19
  3. Disclosed 2024-08-26
  4. 47 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak][Fraud]
Entry point
Stolen credentials

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]LINE公式アカウントにおけるアカウント乗っ取りに関するお知らせとお願いLY Corporation · 2024-08-26
  2. [2][News]LINE企業アカウント688件で乗っ取り　不正にログインNikkei · 2024-08-26
  3. [3][News]LINEビジネスIDにパスワードリスト攻撃、攻撃者による不正操作判明ScanNetSecurity · 2024-09-03 08:05