> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

LY Corp: a defect in Yahoo! JAPAN ID SMS login may have let third parties read Yahoo! Mail

A check that the phone number owner had not changed failed, so a new holder of a number could log in to the previous holder's ID and may have read Yahoo! Mail.

Disclosed

2024-08-05

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It rolled out a system update that contained the defect. [1]

  2. It found the defect and fixed the affected system. [1]

  3. It forced the IDs thought to be affected to log out and blocked them from logging in again. [1]

  4. It identified the IDs whose Yahoo! Mail may have been viewed. [1]

  5. It began notifying the affected users individually and lifted the login block. [1]

  6. It announced the case. [1] [2]

Impact

The defect lasted from June 13 to 27, 2024. What may have been viewed is the subject, body, sent time and sender address of Yahoo! Mail messages. The number of affected users was not published. [1]

Timeline

  1. Started 2024-06-13
  2. Detected 2024-06-27
  3. Disclosed 2024-08-05
  4. 53 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]Yahoo! JAPAN IDログインのシステム不具合に関するお知らせとお詫びLY Corporation · 2024-08-05
  2. [2][News]Yahoo! JAPAN IDログインのシステムで不具合、第三者にYahoo!メールを閲覧された可能性ScanNetSecurity · 2024-08-14 08:05