> JapanHacked_
[Contained][Severity: Moderate][Credential abuse]

Money Forward: Cloud Invoice accounts were hijacked or newly created and abused to send mass suspicious emails

Using IDs and passwords obtained elsewhere, attackers took over or created Money Forward Cloud Invoice accounts and sent mass suspicious emails from the company's address.

Disclosed

2024-08-08

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It announced the case. It said a third party used IDs and passwords obtained somehow to take over user accounts or create new ones and sent mass emails to many recipients through Cloud Invoice. It disabled the 11 abused accounts and stepped up monitoring. [1] [2]

  2. It updated the notice: the abused accounts had risen to 12, and no breach of its own systems or leak of information had been confirmed. [1]

Impact

The emails had foreign-language subjects, some posing as overdue payments or fines. The company urged recipients not to open the emails or follow their links. [1]

Timeline

  1. Detected, Disclosed 2024-08-08
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Fraud]
Entry point
Stolen credentials

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社ユーザー以外の第三者によるアカウント不正利用および大量のメール送付に関する注意喚起 （2024年8月13日更新）Money Forward, Inc. · 2024-08-13
  2. [2][News]「マネーフォワード クラウド請求書」アカウント不正利用しメール大量送信ScanNetSecurity · 2024-08-22 08:05