Japan Post Holdings: credential stuffing against Yu ID

On October 19, Japan Post Holdings disclosed that credential stuffing using IDs and passwords leaked elsewhere may have exposed member data of 249 Yu ID accounts. It detected suspicious access October 15 and stopped the Yu Yu Point site October 16. Potentially viewed data includes names, addresses, birth dates, genders, phones, emails and registered workplace, family and address-book information. One account's 83 address entries may also have been acquired. The affected Yu IDs do not overlap those obtained in the separately disclosed September 29 Japan Post app incident. No new unauthorized access was confirmed after blocking the route; two-step authentication became mandatory October 20.